Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2014-5138 State: PUBLISHED Published: 2020-01-14T15:49:00 Last Updated: 2024-08-06T11:34:37.342Z Vendors: n/a Products: n/a Problem Types: n/a Description: Innovative Interfaces Sierra Library Services Platform 1.2_3 does not properly handle query strings with multiple instances of the same parameter, which allows remote attackers to bypass parameter validation via unspecified vectors, possibly related to the Webpac Pro submodule. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/128053/Sierra-Library-Services-Platform-1.2_3-XSS-Enumeration.html
CVE ID: CVE-2014-5139 State: PUBLISHED Published: 2014-08-13T23:00:00 Last Updated: 2024-08-06T11:34:37.376Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ssl_set_client_disabled function in t1_lib.c in OpenSSL 1.0.1 before 1.0.1i allows remote SSL servers to cause a denial of service (NULL pointer dereference and client application crash) via a ServerHello message that includes an SRP ciphersuite without the required negotiation of that ciphersuite with the client. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-updates/2014-08/msg00036.html - http://support.f5.com/kb/en-us/solutions/public/15000/500/sol15567.html - http:/
pensuse-updates/2014-08/msg00036.html - http://support.f5.com/kb/en-us/solutions/public/15000/500/sol15567.html - http://secunia.com/advisories/60221 - http://www-01.ibm.com/support/docview.wss?uid=swg21682293 - http://secunia.com/advisories/61184 - http://marc.info/?l=bugtraq&m=142660345230545&w=2 - http://secunia.com/advisories/60022 - https://www.openssl.org/news/secadv_20140806.txt - http://secunia.com/advisories/61017 - http://marc.info/?l=bugtraq&m=142350350616251&w=2 - http://www-01.ibm.com/support/docview.wss?uid=swg21683389 - http://marc.info/?l=bugtraq&m=142791032306609&w=2 - http://marc.info/?l=bugtraq&m=142624619906067&w=2 - http://www.huawei.com/en/security/psirt/security-bullet
306609&w=2 - http://marc.info/?l=bugtraq&m=142624619906067&w=2 - http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-372998.htm - http://security.gentoo.org/glsa/glsa-201412-39.xml - http://marc.info/?l=bugtraq&m=142660345230545&w=2 - http://www.securityfocus.com/bid/69077 - http://marc.info/?l=bugtraq&m=142495837901899&w=2 - http://secunia.com/advisories/60803 - https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=80bd7b41b30af6ee96f519e629463583318de3b0 - http://secunia.com/advisories/59700 - http://www.securitytracker.com/id/1030693 - http://secunia.com/advisories/60917 - http://marc.info/?l=bugtraq&m=142350350616251&w=2 - http://www.tenable.com/secur
- http://secunia.com/advisories/60917 - http://marc.info/?l=bugtraq&m=142350350616251&w=2 - http://www.tenable.com/security/tns-2014-06 - ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-008.txt.asc - http://secunia.com/advisories/60493 - http://secunia.com/advisories/59710 - http://secunia.com/advisories/60921 - http://secunia.com/advisories/60810 - http://marc.info/?l=bugtraq&m=142624679706236&w=2 - http://www-01.ibm.com/support/docview.wss?uid=nas8N1020240 - http://secunia.com/advisories/61100 - https://www.freebsd.org/security/advisories/FreeBSD-SA-14:18.openssl.asc - http://secunia.com/advisories/61775 - http://marc.info/?l=bugtraq&m=142495837901899&w=2 - http://www.deb
8.openssl.asc - http://secunia.com/advisories/61775 - http://marc.info/?l=bugtraq&m=142495837901899&w=2 - http://www.debian.org/security/2014/dsa-2998 - http://marc.info/?l=bugtraq&m=143290437727362&w=2 - http://marc.info/?l=bugtraq&m=142624719706349&w=2 - http://secunia.com/advisories/61959 - http://secunia.com/advisories/59756 - http://marc.info/?l=bugtraq&m=142624719706349&w=2 - http://marc.info/?l=bugtraq&m=142624590206005&w=2 - http://marc.info/?l=bugtraq&m=143290522027658&w=2 - http://aix.software.ibm.com/aix/efixes/security/openssl_advisory10.asc - http://secunia.com/advisories/61392 - http://marc.info/?l=bugtraq&m=142624679706236&w=2 - https://lists.balabit.hu/pipermail/syslog-ng-ann
/advisories/61392 - http://marc.info/?l=bugtraq&m=142624679706236&w=2 - https://lists.balabit.hu/pipermail/syslog-ng-announce/2014-September/000196.html - http://secunia.com/advisories/61171 - https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=83764a989dcc87fbea337da5f8f86806fe767b7e - http://marc.info/?l=bugtraq&m=142624619906067 - http://www-01.ibm.com/support/docview.wss?uid=swg21686997
CVE ID: CVE-2014-5140 State: PUBLISHED Published: 2020-01-03T19:50:52 Last Updated: 2024-08-06T11:34:37.518Z Vendors: n/a Products: n/a Problem Types: n/a Description: The bindReplace function in the query factory in includes/classes/database.php in Loaded Commerce 7 does not properly handle : (colon) characters, which allows remote authenticated users to conduct SQL injection attacks via the First name and Last name fields in the address book. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/128183/Loaded-Commerce-7-Shopping-Cart-SQL-Injection.html - http://resources.infosecinstitute.com/exploiting-systemic-query-vulnerabilities-attempt-r
ping-Cart-SQL-Injection.html - http://resources.infosecinstitute.com/exploiting-systemic-query-vulnerabilities-attempt-re-invent-pdo/ - http://www.exploit-db.com/exploits/34552 - https://exchange.xforce.ibmcloud.com/vulnerabilities/95791 - https://github.com/loadedcommerce/loaded7/pull/520
CVE ID: CVE-2014-5144 State: PUBLISHED Published: 2017-08-09T18:00:00 Last Updated: 2024-08-06T11:34:37.467Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Telescope before 0.9.3 allows remote authenticated users to inject arbitrary web script or HTML via crafted markdown. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/36463/ - http://www.telescopeapp.org/blog/telescope-v093-dailyscope/
CVE ID: CVE-2014-5146 State: PUBLISHED Published: 2014-08-22T14:00:00 Last Updated: 2024-08-06T11:34:37.443Z Vendors: n/a Products: n/a Problem Types: n/a Description: Certain MMU virtualization operations in Xen 4.2.x through 4.4.x before the xsa97-hap patch, when using Hardware Assisted Paging (HAP), are not preemptible, which allows local HVM guest to cause a denial of service (vcpu consumption) by invoking these operations, which process every page assigned to a guest, a different vulnerability than CVE-2014-5149. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201504-04 - http://xenbits.xen.org/xsa/advisory-97.html - http://www.securityf
ences: - https://security.gentoo.org/glsa/201504-04 - http://xenbits.xen.org/xsa/advisory-97.html - http://www.securityfocus.com/bid/69198 - http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136980.html - http://www.securitytracker.com/id/1030723 - https://exchange.xforce.ibmcloud.com/vulnerabilities/95234 - http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136981.html - http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00005.html - http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00010.html
CVE ID: CVE-2014-5147 State: PUBLISHED Published: 2014-08-29T17:00:00 Last Updated: 2024-08-06T11:34:37.527Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xen 4.4.x, when running a 64-bit kernel on an ARM system, does not properly handle traps from the guest domain that use a different address width, which allows local guest users to cause a denial of service (host crash) via a crafted 32-bit process. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1030724 - http://xenbits.xen.org/xsa/advisory-102.html
CVE ID: CVE-2014-5148 State: PUBLISHED Published: 2014-10-26T20:00:00 Last Updated: 2024-08-06T11:34:37.474Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xen 4.4.x, when running on an ARM system and "handling an unknown system register access from 64-bit userspace," returns to an instruction of the trap handler for kernel space faults instead of an instruction that is associated with faults in 64-bit userspace, which allows local guest users to cause a denial of service (crash) and possibly gain privileges via a crafted process. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/59934 - https://exchange.xforce.ibmcloud.com/vulnerabili
Program Container: References: - http://secunia.com/advisories/59934 - https://exchange.xforce.ibmcloud.com/vulnerabilities/95233 - http://xenbits.xenproject.org/xsa/advisory-103.html - http://www.securitytracker.com/id/1030725 - http://www.securityfocus.com/bid/69189
CVE ID: CVE-2014-5149 State: PUBLISHED Published: 2014-08-22T14:00:00 Last Updated: 2024-08-06T11:34:37.436Z Vendors: n/a Products: n/a Problem Types: n/a Description: Certain MMU virtualization operations in Xen 4.2.x through 4.4.x, when using shadow pagetables, are not preemptible, which allows local HVM guest to cause a denial of service (vcpu consumption) by invoking these operations, which process every page assigned to a guest, a different vulnerability than CVE-2014-5146. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201504-04 - http://xenbits.xen.org/xsa/advisory-97.html - http://lists.fedoraproject.org/pipermail/package-announce/20
a/201504-04 - http://xenbits.xen.org/xsa/advisory-97.html - http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136980.html - http://www.securitytracker.com/id/1030723 - http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136981.html - http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00005.html - http://www.securityfocus.com/bid/69199 - http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00010.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/95235
CVE ID: CVE-2014-5157 State: REJECTED Published: 2014-08-13T18:00:00 Last Updated: 2014-08-13T18:57:01 Description: No description available.
CVE ID: CVE-2014-5158 State: PUBLISHED Published: 2014-08-21T14:00:00 Last Updated: 2024-08-06T11:34:37.653Z Vendors: n/a Products: n/a Problem Types: n/a Description: The (1) av-centerd SOAP service and (2) backup command in the ossim-framework service in AlienVault OSSIM before 4.6.0 allows remote attackers to execute arbitrary commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.zerodayinitiative.com/advisories/ZDI-14-273/ - http://forums.alienvault.com/discussion/2559/security-advisory-multiple-vulnerabilities - http://www.zerodayinitiative.com/advisories/ZDI-14-272/
CVE ID: CVE-2014-5159 State: PUBLISHED Published: 2014-08-21T14:00:00 Last Updated: 2024-08-06T11:34:37.482Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the ossim-framework service in AlienVault OSSIM before 4.6.0 allows remote attackers to execute arbitrary SQL commands via the ws_data parameter. Additional Analyst Notes: - CVE Program Container: References: - http://forums.alienvault.com/discussion/2559/security-advisory-multiple-vulnerabilities - http://www.zerodayinitiative.com/advisories/ZDI-14-271/
CVE ID: CVE-2014-5160 State: PUBLISHED Published: 2014-08-01T10:00:00 Last Updated: 2024-08-06T11:34:37.570Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple directory traversal vulnerabilities in crs.exe in the Cell Request Service in HP Data Protector allow remote attackers to create arbitrary files via an opcode-1091 request, or create or delete arbitrary files via an opcode-305 request. NOTE: the vendor reportedly asserts that this behavior is "by design. Additional Analyst Notes: - CVE Program Container: References: - http://zerodayinitiative.com/advisories/ZDI-14-262/ - http://zerodayinitiative.com/advisories/ZDI-14-263/
CVE ID: CVE-2014-5161 State: PUBLISHED Published: 2014-08-01T10:00:00 Last Updated: 2024-08-06T11:34:37.587Z Vendors: n/a Products: n/a Problem Types: n/a Description: The dissect_log function in plugins/irda/packet-irda.c in the IrDA dissector in Wireshark 1.10.x before 1.10.9 does not properly strip '\n' characters, which allows remote attackers to cause a denial of service (buffer underflow and application crash) via a crafted packet. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-updates/2014-09/msg00058.html - http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00033.html - http://www.debian.org/security/2014/dsa-3002 - ht
/lists.opensuse.org/opensuse-security-announce/2014-09/msg00033.html - http://www.debian.org/security/2014/dsa-3002 - http://lists.opensuse.org/opensuse-updates/2014-08/msg00025.html - http://www.wireshark.org/security/wnpa-sec-2014-08.html - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=16f8ba1bed579344df373bf38fff552ab8baf380 - http://secunia.com/advisories/57593
CVE ID: CVE-2014-5162 State: PUBLISHED Published: 2014-08-01T10:00:00 Last Updated: 2024-08-06T11:34:37.547Z Vendors: n/a Products: n/a Problem Types: n/a Description: The read_new_line function in wiretap/catapult_dct2000.c in the Catapult DCT2000 dissector in Wireshark 1.10.x before 1.10.9 does not properly strip '\n' and '\r' characters, which allows remote attackers to cause a denial of service (off-by-one buffer underflow and application crash) via a crafted packet. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-updates/2014-09/msg00058.html - http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00033.html - http://www.debi
tes/2014-09/msg00058.html - http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00033.html - http://www.debian.org/security/2014/dsa-3002 - http://lists.opensuse.org/opensuse-updates/2014-08/msg00025.html - http://www.wireshark.org/security/wnpa-sec-2014-08.html - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=16f8ba1bed579344df373bf38fff552ab8baf380 - http://secunia.com/advisories/57593
CVE ID: CVE-2014-5163 State: PUBLISHED Published: 2014-08-01T10:00:00 Last Updated: 2024-08-06T11:34:37.521Z Vendors: n/a Products: n/a Problem Types: n/a Description: The APN decode functionality in (1) epan/dissectors/packet-gtp.c and (2) epan/dissectors/packet-gsm_a_gm.c in the GTP and GSM Management dissectors in Wireshark 1.10.x before 1.10.9 does not completely initialize a certain buffer, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10216 - http://lists.opensuse.org/opensuse-updates/2014-09/msg00058.html - https://
reshark.org/bugzilla/show_bug.cgi?id=10216 - http://lists.opensuse.org/opensuse-updates/2014-09/msg00058.html - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=3fc441e7a5008640c68ec985e669d5092414a519 - http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00033.html - http://www.debian.org/security/2014/dsa-3002 - http://www.wireshark.org/security/wnpa-sec-2014-09.html - http://lists.opensuse.org/opensuse-updates/2014-08/msg00025.html - http://secunia.com/advisories/57593 - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=dd7134d907350ccc574cdec596f4162860912bb9
CVE ID: CVE-2014-5164 State: PUBLISHED Published: 2014-08-01T10:00:00 Last Updated: 2024-08-06T11:34:37.622Z Vendors: n/a Products: n/a Problem Types: n/a Description: The rlc_decode_li function in epan/dissectors/packet-rlc.c in the RLC dissector in Wireshark 1.10.x before 1.10.9 initializes a certain structure member only after this member is used, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-updates/2014-09/msg00058.html - http://www.wireshark.org/security/wnpa-sec-2014-10.html - http://lists.opensuse.org/opensuse-security-announce/201
tml - http://www.wireshark.org/security/wnpa-sec-2014-10.html - http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00033.html - http://www.debian.org/security/2014/dsa-3002 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9795 - http://lists.opensuse.org/opensuse-updates/2014-08/msg00025.html - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=ba6eb5c72ffe82ca0e51c7083240975a5b118ad2 - http://secunia.com/advisories/57593
CVE ID: CVE-2014-5165 State: PUBLISHED Published: 2014-08-01T10:00:00 Last Updated: 2024-08-06T11:34:37.550Z Vendors: n/a Products: n/a Problem Types: n/a Description: The dissect_ber_constrained_bitstring function in epan/dissectors/packet-ber.c in the ASN.1 BER dissector in Wireshark 1.10.x before 1.10.9 does not properly validate padding values, which allows remote attackers to cause a denial of service (buffer underflow and application crash) via a crafted packet. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10187 - http://lists.opensuse.org/opensuse-updates/2014-09/msg00058.html - http://lists.opensuse.org/opensuse-
ug.cgi?id=10187 - http://lists.opensuse.org/opensuse-updates/2014-09/msg00058.html - http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00033.html - http://www.debian.org/security/2014/dsa-3002 - http://lists.opensuse.org/opensuse-updates/2014-08/msg00025.html - http://www.wireshark.org/security/wnpa-sec-2014-11.html - http://secunia.com/advisories/57593 - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=17a552666b50896a9b9dde8ee6a1052e7f9a622e
CVE ID: CVE-2014-5169 State: PUBLISHED Published: 2014-10-20T17:00:00 Last Updated: 2024-08-06T11:34:37.526Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Date module before 7.x-2.8 for Drupal allows remote authenticated users with the permission to create a date field to inject arbitrary web script or HTML via the date field title. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2014/07/31/2 - http://www.securityfocus.com/bid/68974 - https://www.drupal.org/node/2312609 - https://www.drupal.org/node/2311887 - http://www.openwall.com/lists/oss-security/2014/07/31/4
CVE ID: CVE-2014-5170 State: PUBLISHED Published: 2018-03-29T18:00:00 Last Updated: 2024-08-06T11:34:37.527Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Storage API module 7.x before 7.x-1.6 for Drupal might allow remote attackers to execute arbitrary code by leveraging failure to update .htaccess file contents after SA-CORE-2013-003. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/node/2312769 - https://www.drupal.org/node/2312655 - https://exchange.xforce.ibmcloud.com/vulnerabilities/95054 - http://www.openwall.com/lists/oss-security/2014/07/31/4
CVE ID: CVE-2014-5171 State: PUBLISHED Published: 2014-07-31T14:00:00 Last Updated: 2024-10-21T16:50:44.135Z Vendors: n/a Products: n/a Problem Types: n/a Description: SAP HANA Extend Application Services (XS) does not encrypt transmissions for applications that enable form based authentication using SSL, which allows remote attackers to obtain credentials and other sensitive information by sniffing the network. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-021 - https://service.sap.com/sap/support/notes/1963932 - http://www.securityfocus.com/bid/68947 - http://www.securityfocus.com/ar
s://service.sap.com/sap/support/notes/1963932 - http://www.securityfocus.com/bid/68947 - http://www.securityfocus.com/archive/1/532940/100/0/threaded - http://seclists.org/fulldisclosure/2014/Jul/149 - http://scn.sap.com/docs/DOC-8218 - http://packetstormsecurity.com/files/127666/SAP-HANA-XS-Missing-Encryption.html
CVE ID: CVE-2014-5172 State: PUBLISHED Published: 2014-07-31T14:00:00 Last Updated: 2024-08-06T11:34:37.519Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the XS Administration Tools in SAP HANA allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2014/Jul/153 - http://packetstormsecurity.com/files/127670/SAP-HANA-XS-Administration-Tool-Cross-Site-Scripting.html - http://www.securityfocus.com/bid/68952 - https://service.sap.com/sap/support/notes/1993349 - http://secunia.com/advisories/59634 -
securityfocus.com/bid/68952 - https://service.sap.com/sap/support/notes/1993349 - http://secunia.com/advisories/59634 - http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-025 - http://www.securityfocus.com/archive/1/532941/100/0/threaded - http://scn.sap.com/docs/DOC-8218 - https://exchange.xforce.ibmcloud.com/vulnerabilities/94922
CVE ID: CVE-2014-5173 State: PUBLISHED Published: 2014-07-31T14:00:00 Last Updated: 2024-12-04T15:31:45.998Z Vendors: n/a Products: n/a Problem Types: n/a Description: SAP HANA Extend Application Services (XS) allows remote attackers to bypass access restrictions via a request to a private IU5 SDK application that was once public. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/94931 - http://packetstormsecurity.com/files/127667/SAP-HANA-IU5-SDK-Authentication-Bypass.html - http://seclists.org/fulldisclosure/2014/Jul/150 - http://scn.sap.com/docs/DOC-8218 - http://www.securityfocus.com/archive/1/53
/seclists.org/fulldisclosure/2014/Jul/150 - http://scn.sap.com/docs/DOC-8218 - http://www.securityfocus.com/archive/1/532944/100/0/threaded - http://www.securityfocus.com/bid/68950 - https://service.sap.com/sap/support/notes/1964428
CVE ID: CVE-2014-5174 State: PUBLISHED Published: 2014-07-31T14:00:00 Last Updated: 2024-08-06T11:34:37.502Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SAP Netweaver Business Warehouse component does not properly restrict access to the functions in the BW-SYS-DB-DB4 function group, which allows remote authenticated users to obtain sensitive information via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-026 - https://exchange.xforce.ibmcloud.com/vulnerabilities/94921 - http://scn.sap.com/docs/DOC-8218 - http://www.securityfocus.com/bid/68955 - http://secunia.com/advisorie
ilities/94921 - http://scn.sap.com/docs/DOC-8218 - http://www.securityfocus.com/bid/68955 - http://secunia.com/advisories/59635 - https://service.sap.com/sap/support/notes/1974016 - http://seclists.org/fulldisclosure/2014/Jul/154 - http://packetstormsecurity.com/files/127671/SAP-Netweaver-Business-Warehouse-Missing-Authorization.html
CVE ID: CVE-2014-5175 State: PUBLISHED Published: 2014-07-31T14:00:00 Last Updated: 2024-08-06T11:34:37.559Z Vendors: n/a Products: n/a Problem Types: n/a Description: The License Measurement servlet in SAP Solution Manager 7.1 allows remote attackers to bypass authentication via unspecified vectors, related to a verb tampering attack and SAP_JTECHS. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2014/Jul/151 - http://secunia.com/advisories/59548 - https://service.sap.com/sap/support/notes/1778940 - https://exchange.xforce.ibmcloud.com/vulnerabilities/94932 - http://scn.sap.com/docs/DOC-8218 - http://www.onapsis.com/resources/get.php?resid
e.ibmcloud.com/vulnerabilities/94932 - http://scn.sap.com/docs/DOC-8218 - http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-023 - http://www.securityfocus.com/bid/68949