Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2014-9398 State: PUBLISHED Published: 2014-12-31T21:00:00 Last Updated: 2024-08-06T13:40:24.958Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in the Twitter LiveBlog plugin 1.1.2 and earlier for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the mashtlb_twitter_username parameter in the twitter-liveblog.php page to wp-admin/options-general.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/129644/WordPress-Twitter-LiveBlog-1.1.2-CSRF-XSS.html
CVE ID: CVE-2014-9399 State: PUBLISHED Published: 2014-12-31T21:00:00 Last Updated: 2024-08-06T13:40:25.240Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in the TweetScribe plugin 1.1 and earlier for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the tweetscribe_username parameter in a save action in the tweetscribe.php page to wp-admin/options-general.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/129645/WordPress-TweetScribe-1.1-CSRF-XSS.html
CVE ID: CVE-2014-9400 State: PUBLISHED Published: 2014-12-31T21:00:00 Last Updated: 2024-08-06T13:40:25.037Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Wp Unique Article Header Image plugin 1.0 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) gt_default_header or (2) gt_homepage_header parameter in the wp-unique-header.php page to wp-admin/options-general.php. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/99355 - http://pa
yst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/99355 - http://packetstormsecurity.com/files/129646/WordPress-WP-Unique-Article-Header-Image-1.0-CSRF-XSS.html
CVE ID: CVE-2014-9401 State: PUBLISHED Published: 2014-12-31T21:00:00 Last Updated: 2024-08-06T13:40:25.216Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in the WP Limit Posts Automatically plugin 0.7 and earlier for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the lpa_post_letters parameter in the wp-limit-posts-automatically.php page to wp-admin/options-general.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/129647/WordPress-WP-Limit-Posts-Automatically-0.7-CSRF-XSS.html
ner: References: - http://packetstormsecurity.com/files/129647/WordPress-WP-Limit-Posts-Automatically-0.7-CSRF-XSS.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/99427
CVE ID: CVE-2014-9402 State: PUBLISHED Published: 2015-02-24T15:00:00 Last Updated: 2024-08-06T13:40:25.176Z Vendors: n/a Products: n/a Problem Types: n/a Description: The nss_dns implementation of getnetbyname in GNU C Library (aka glibc) before 2.21, when the DNS backend in the Name Service Switch configuration is enabled, allows remote attackers to cause a denial of service (infinite loop) by sending a positive answer while a network name is being process. Additional Analyst Notes: - CVE Program Container: References: - http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html - https://sourceware.org/bugzilla/show_bug.cgi?id=17630 - http://lists.opensuse.org/opensuse-up
/cpujan2018-3236628.html - https://sourceware.org/bugzilla/show_bug.cgi?id=17630 - http://lists.opensuse.org/opensuse-updates/2015-02/msg00089.html - https://security.gentoo.org/glsa/201602-02 - http://www.openwall.com/lists/oss-security/2014/12/18/1 - http://www.ubuntu.com/usn/USN-2519-1 - http://www.securityfocus.com/bid/71670 - https://access.redhat.com/errata/RHSA-2018:0805 - http://seclists.org/fulldisclosure/2019/Jun/18 - https://seclists.org/bugtraq/2019/Jun/14 - http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html - http://seclists.org/fulldisclosure/2019/Sep/7 - https://seclists.org/bugtraq/2019/Sep/7 - http:
coded-Credentials.html - http://seclists.org/fulldisclosure/2019/Sep/7 - https://seclists.org/bugtraq/2019/Sep/7 - http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html
CVE ID: CVE-2014-9403 State: PUBLISHED Published: 2014-12-19T15:00:00 Last Updated: 2024-08-06T13:40:25.180Z Vendors: n/a Products: n/a Problem Types: n/a Description: The CWebAdminMod::ChanPage function in modules/webadmin.cpp in ZNC before 1.4 allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) by adding a channel with the same name as an existing channel but without the leading # character, related to a "use-after-delete" error. Additional Analyst Notes: - CVE Program Container: References: - http://advisories.mageia.org/MGASA-2014-0543.html - https://github.com/znc/znc/issues/528 - http://www.mandriva.com/security/advisories?name=MDVSA-2015
ASA-2014-0543.html - https://github.com/znc/znc/issues/528 - http://www.mandriva.com/security/advisories?name=MDVSA-2015:013 - http://www.openwall.com/lists/oss-security/2014/12/18/2 - http://www.securityfocus.com/bid/66926 - https://github.com/znc/znc/blob/master/ChangeLog.md - http://secunia.com/advisories/57795
CVE ID: CVE-2014-9404 State: REJECTED Published: 2020-02-17T18:22:26 Last Updated: 2020-02-17T18:22:26 Description: No description available.
CVE ID: CVE-2014-9405 State: PUBLISHED Published: 2020-01-06T21:16:38 Last Updated: 2024-08-06T13:40:25.043Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Scripting (XSS) vulnerability exists in the description field of an Download RSS item or Contacts in Freebox OS Web interface 3.0.2, which allows malicious users to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/132121/FreeBox-3.0.2-Cross-Site-Request-Forgery-Cross-Site-Scripting.html - http://www.securityfocus.com/bid/74936 - http://seclists.org/fulldisclosure/2015/Jun/1 - http://www.securityfocus.com/archive/1/535660/100/0/threaded
CVE ID: CVE-2014-9406 State: PUBLISHED Published: 2014-12-18T15:00:00Z Last Updated: 2024-09-17T02:47:02.110Z Vendors: n/a Products: n/a Problem Types: n/a Description: ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier has a default password of password for the admin account, which makes it easier for remote attackers to obtain access via a request to home_loggedout.php. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2014/Dec/57
CVE ID: CVE-2014-9407 State: PUBLISHED Published: 2014-12-19T15:00:00Z Last Updated: 2024-09-16T18:29:24.904Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Revive Adserver before 3.0.5 allow remote attackers to hijack the authentication of administrators for requests that (1) delete data via a request to agency-delete.php, (2) tracker-delete.php, or (3) userlog-delete.php in admin/ or (4) unlink accounts via a request to admin-user-unlink.php. (5) advertiser-user-unlink.php, or (6) affiliate-user-unlink.php in admin/. Additional Analyst Notes: - CVE Program Container: References: - http://www.revive-adserver.com/secur
ink.php in admin/. Additional Analyst Notes: - CVE Program Container: References: - http://www.revive-adserver.com/security/revive-sa-2014-001/
CVE ID: CVE-2014-9408 State: PUBLISHED Published: 2014-12-19T15:00:00 Last Updated: 2024-08-06T13:40:25.174Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ekahau B4 staff badge tag 5.7 with firmware 1.4.52, Real-Time Location System (RTLS) Controller 6.0.5-FINAL, and Activator 3 uses part of the MAC address as part of the RC4 setup key, which makes it easier for remote attackers to guess the key via a brute-force attack. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/129585/Ekahau-Real-Time-Location-System-RC4-Cipher-Stream-Reuse-Weak-Key-Derivation.html - http://www.securityfocus.com/bid/71674 - http://www.modzero.ch/adviso
RC4-Cipher-Stream-Reuse-Weak-Key-Derivation.html - http://www.securityfocus.com/bid/71674 - http://www.modzero.ch/advisories/MZ-14-01-Ekahau-RTLS.txt - http://www.securityfocus.com/archive/1/534241/100/0/threaded
CVE ID: CVE-2014-9410 State: PUBLISHED Published: 2016-08-07T21:00:00 Last Updated: 2024-08-06T13:40:25.216Z Vendors: n/a Products: n/a Problem Types: n/a Description: The vfe31_proc_general function in drivers/media/video/msm/vfe/msm_vfe31.c in the MSM-VFE31 driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not validate a certain id value, which allows attackers to gain privileges or cause a denial of service (memory corruption) via an application that makes a crafted ioctl call. Additional Analyst Notes: - CVE Program Container: References: - https://www.codeaurora.org/security-advisory/multiple-issu
itional Analyst Notes: - CVE Program Container: References: - https://www.codeaurora.org/security-advisory/multiple-issues-in-camera-drivers-cve-2014-9410-cve-2015-0568
CVE ID: CVE-2014-9411 State: PUBLISHED Published: 2017-08-18T18:00:00Z Last Updated: 2024-09-16T21:07:53.773Z Vendors: Qualcomm, Inc. Products: All Qualcomm products Problem Types: Use of Out-of-range Pointer Offset in Core Description: In all Qualcomm products with Android releases from CAF using the Linux kernel, the use of an out-of-range pointer offset is potentially possible in rollback protection. Additional Analyst Notes: - CVE Program Container: References: - https://source.android.com/security/bulletin/2017-07-01 - http://www.securityfocus.com/bid/99467
CVE ID: CVE-2014-9412 State: PUBLISHED Published: 2014-12-23T11:00:00 Last Updated: 2024-08-06T13:40:25.221Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in NetIQ Access Manager (NAM) 4.x before 4.1 allow remote attackers to inject arbitrary web script or HTML via (1) an arbitrary parameter to roma/jsp/debug/debug.jsp or (2) an arbitrary parameter in a debug.DumpAll action to nps/servlet/webacc, a different issue than CVE-2014-5216. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2014/Dec/78 - https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20141218-2_N
sts.org/fulldisclosure/2014/Dec/78 - https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20141218-2_Novell_NetIQ_Access_Manager_Multiple_Vulnerabilities_v10.txt - https://www.novell.com/support/kb/doc.php?id=7015994 - http://packetstormsecurity.com/files/129658/NetIQ-Access-Manager-4.0-SP1-XSS-CSRF-XXE-Injection-Disclosure.html
CVE ID: CVE-2014-9413 State: PUBLISHED Published: 2014-12-24T18:00:00 Last Updated: 2024-08-06T13:40:25.199Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the IP Ban (simple-ip-ban) plugin 1.2.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) ip_list, (2) user_agent_list, or (3) redirect_url parameter in the simple-ip-ban page to wp-admin/options-general.php. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/99503 - https://wordpress.org/plugin
ogram Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/99503 - https://wordpress.org/plugins/simple-ip-ban/changelog/ - http://packetstormsecurity.com/files/129500/WordPress-IP-Ban-1.2.3-CSRF-XSS.html
CVE ID: CVE-2014-9414 State: PUBLISHED Published: 2014-12-24T18:00:00 Last Updated: 2024-08-06T13:40:25.226Z Vendors: n/a Products: n/a Problem Types: n/a Description: The W3 Total Cache plugin before 0.9.4.1 for WordPress does not properly handle empty nonces, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and hijack the authentication of administrators for requests that change the mobile site redirect URI via the mobile_groups[*][redirect] parameter and an empty _wpnonce parameter in the w3tc_mobile page to wp-admin/admin.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wp-plugins/w3-total-cache/commit/9a1cc9f70558
l Analyst Notes: - CVE Program Container: References: - https://github.com/wp-plugins/w3-total-cache/commit/9a1cc9f70558282e135eb3120d271448c75b28dd#diff-86a10b31ab115483fe8111bedac14d15 - http://mazinahmed1.blogspot.com/2014/12/w3-total-caches-w3totalfail.html - https://wordpress.org/plugins/w3-total-cache/changelog/ - https://exchange.xforce.ibmcloud.com/vulnerabilities/99352 - http://www.securityfocus.com/archive/1/534250/100/0/threaded - http://seclists.org/fulldisclosure/2014/Dec/67 - http://packetstormsecurity.com/files/129512/W3-Total-Cache-0.9.4-Cross-Site-Request-Forgery.html - http://secunia.com/advisories/61562
CVE ID: CVE-2014-9415 State: PUBLISHED Published: 2014-12-24T18:00:00 Last Updated: 2024-08-06T13:40:25.205Z Vendors: n/a Products: n/a Problem Types: n/a Description: Huawei eSpace Desktop before V100R001C03 allows local users to cause a denial of service (program exit) via a crafted QES file. Additional Analyst Notes: - CVE Program Container: References: - http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-406589.htm - http://packetstormsecurity.com/files/152965/Huawei-eSpace-1.1.11.103-Unicode-Stack-Buffer-Overflow.html
CVE ID: CVE-2014-9416 State: PUBLISHED Published: 2014-12-24T18:00:00 Last Updated: 2024-08-06T13:40:25.336Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple untrusted search path vulnerabilities in Huawei eSpace Desktop before V200R003C00 allow local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse (1) mfc71enu.dll, (2) mfc71loc.dll, (3) tcapi.dll, or (4) airpcap.dll. Additional Analyst Notes: - CVE Program Container: References: - http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-406589.htm - http://packetstormsecurity.com/files/152966/Huawei-eSpace-1.1.11.103-DLL-Hijacking.html
CVE ID: CVE-2014-9417 State: PUBLISHED Published: 2014-12-24T18:00:00 Last Updated: 2024-08-06T13:40:25.168Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Meeting component in Huawei eSpace Desktop before V100R001C03 allows local users to cause a denial of service (program exit) via a crafted image. Additional Analyst Notes: - CVE Program Container: References: - http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-406589.htm - http://packetstormsecurity.com/files/152967/Huawei-eSpace-1.1.11.103-Meeting-Image-File-Format-Handling-Buffer-Overflow.html
CVE ID: CVE-2014-9418 State: PUBLISHED Published: 2014-12-24T18:00:00 Last Updated: 2024-08-06T13:40:25.227Z Vendors: n/a Products: n/a Problem Types: n/a Description: The eSpace Meeting ActiveX control (eSpaceStatusCtrl.dll) in Huawei eSpace Desktop before V200R001C03 allows local users to cause a denial of service (memory overflow) via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-406589.htm - http://packetstormsecurity.com/files/152968/Huawei-eSpace-1.1.11.103-Meeting-Heap-Overflow.html
CVE ID: CVE-2014-9419 State: PUBLISHED Published: 2014-12-26T00:00:00 Last Updated: 2024-08-06T13:40:25.223Z Vendors: n/a Products: n/a Problem Types: n/a Description: The __switch_to function in arch/x86/kernel/process_64.c in the Linux kernel through 3.18.1 does not ensure that Thread Local Storage (TLS) descriptors are loaded before proceeding with other steps, which makes it easier for local users to bypass the ASLR protection mechanism via a crafted application that reads a TLS base address. Additional Analyst Notes: - CVE Program Container: References: - http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147864.html - http://www.ubuntu.com/usn/USN-2515-1 - https://g
fedoraproject.org/pipermail/package-announce/2015-January/147864.html - http://www.ubuntu.com/usn/USN-2515-1 - https://github.com/torvalds/linux/commit/f647d7c155f069c1a068030255c300663516420e - http://www.ubuntu.com/usn/USN-2542-1 - http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00015.html - http://www.ubuntu.com/usn/USN-2541-1 - https://bugzilla.redhat.com/show_bug.cgi?id=1177260 - http://www.ubuntu.com/usn/USN-2518-1 - http://www.mandriva.com/security/advisories?name=MDVSA-2015:058 - http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147973.html - http://www.securityfocus.com/bid/71794 - http://lists.opensuse.org/opensuse-security-announce/2015-03/msg0
147973.html - http://www.securityfocus.com/bid/71794 - http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00020.html - http://www.openwall.com/lists/oss-security/2014/12/25/1 - http://www.ubuntu.com/usn/USN-2517-1 - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=f647d7c155f069c1a068030255c300663516420e - http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00009.html - http://www.debian.org/security/2015/dsa-3128 - http://www.ubuntu.com/usn/USN-2516-1 - http://rhn.redhat.com/errata/RHSA-2015-1081.html
CVE ID: CVE-2014-9420 State: PUBLISHED Published: 2014-12-26T00:00:00 Last Updated: 2024-08-06T13:47:41.122Z Vendors: n/a Products: n/a Problem Types: n/a Description: The rock_continue function in fs/isofs/rock.c in the Linux kernel through 3.18.1 does not restrict the number of Rock Ridge continuation entries, which allows local users to cause a denial of service (infinite loop, and system crash or hang) via a crafted iso9660 image. Additional Analyst Notes: - CVE Program Container: References: - http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147864.html - https://source.android.com/security/bulletin/2017-01-01.html - http://www.ubuntu.com/usn/USN-2515-1 - http://ww
4.html - https://source.android.com/security/bulletin/2017-01-01.html - http://www.ubuntu.com/usn/USN-2515-1 - http://www.ubuntu.com/usn/USN-2491-1 - http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00015.html - http://www.ubuntu.com/usn/USN-2490-1 - http://www.ubuntu.com/usn/USN-2492-1 - http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00000.html - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=f54e18f1b831c92f6512d2eedb224cd63d607d3d - http://secunia.com/advisories/62801 - http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html - http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00035.h
ics/security/linuxbulletinjan2016-2867209.html - http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00035.html - http://rhn.redhat.com/errata/RHSA-2015-1138.html - http://www.ubuntu.com/usn/USN-2518-1 - http://www.mandriva.com/security/advisories?name=MDVSA-2015:058 - http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147973.html - http://www.ubuntu.com/usn/USN-2493-1 - https://github.com/torvalds/linux/commit/f54e18f1b831c92f6512d2eedb224cd63d607d3d - http://www.ubuntu.com/usn/USN-2517-1 - http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00009.html - http://www.ubuntu.com/usn/USN-2516-1 - http://rhn.redhat.com/errata/RHSA-2015-1137.html - http
e/2015-04/msg00009.html - http://www.ubuntu.com/usn/USN-2516-1 - http://rhn.redhat.com/errata/RHSA-2015-1137.html - http://www.openwall.com/lists/oss-security/2014/12/25/4 - https://bugzilla.redhat.com/show_bug.cgi?id=1175235 - http://rhn.redhat.com/errata/RHSA-2015-1081.html - http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html
CVE ID: CVE-2014-9421 State: PUBLISHED Published: 2015-02-19T11:00:00 Last Updated: 2024-08-06T13:47:41.430Z Vendors: n/a Products: n/a Problem Types: n/a Description: The auth_gssapi_unwrap_data function in lib/rpc/auth_gssapi_misc.c in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 does not properly handle partial XDR deserialization, which allows remote authenticated users to cause a denial of service (use-after-free and double free, and daemon crash) or possibly execute arbitrary code via malformed XDR data, as demonstrated by data sent to kadmind. Additional Analyst Notes: - CVE Program Container: References: - http://lists.fedoraproject.org/pi
data sent to kadmind. Additional Analyst Notes: - CVE Program Container: References: - http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151437.html - http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt - http://rhn.redhat.com/errata/RHSA-2015-0794.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151103.html - http://www.debian.org/security/2015/dsa-3153 - http://lists.opensuse.org/opensuse-updates/2015-02/msg00044.html - http://rhn.redhat.com/errata/RHSA-2015-0439.html - http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00016.html - http://www.mandriva.com/security/advisories?name=MDVSA-2015:069 - http://www.ubuntu.com/u
nounce/2015-02/msg00016.html - http://www.mandriva.com/security/advisories?name=MDVSA-2015:069 - http://www.ubuntu.com/usn/USN-2498-1 - http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00011.html - http://www.securityfocus.com/bid/72496 - https://github.com/krb5/krb5/commit/a197e92349a4aa2141b5dff12e9dd44c2a2166e3 - http://web.mit.edu/kerberos/advisories/2015-001-patch-r113.txt
CVE ID: CVE-2014-9422 State: PUBLISHED Published: 2015-02-19T11:00:00 Last Updated: 2024-08-06T13:47:40.890Z Vendors: n/a Products: n/a Problem Types: n/a Description: The check_rpcsec_auth function in kadmin/server/kadm_rpc_svc.c in kadmind in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 allows remote authenticated users to bypass a kadmin/* authorization check and obtain administrative access by leveraging access to a two-component principal with an initial "kadmind" substring, as demonstrated by a "ka/x" principal. Additional Analyst Notes: - CVE Program Container: References: - http://lists.fedoraproject.org/pipermail/package-announce/2015-Mar
Analyst Notes: - CVE Program Container: References: - http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151437.html - http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt - http://rhn.redhat.com/errata/RHSA-2015-0794.html - https://github.com/krb5/krb5/commit/6609658db0799053fbef0d7d0aa2f1fd68ef32d8 - http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151103.html - http://www.debian.org/security/2015/dsa-3153 - http://lists.opensuse.org/opensuse-updates/2015-02/msg00044.html - http://rhn.redhat.com/errata/RHSA-2015-0439.html - http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00016.html - http://www.securityfocus.com/bid/72494 - ht
http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00016.html - http://www.securityfocus.com/bid/72494 - http://www.mandriva.com/security/advisories?name=MDVSA-2015:069 - http://www.ubuntu.com/usn/USN-2498-1 - http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00011.html - http://web.mit.edu/kerberos/advisories/2015-001-patch-r113.txt