Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2014-4914 State: PUBLISHED Published: 2017-12-29T14:00:00 Last Updated: 2024-08-06T11:34:36.179Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Zend_Db_Select::order function in Zend Framework before 1.12.7 does not properly handle parentheses, which allows remote attackers to conduct SQL injection attacks via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/58847 - http://openwall.com/lists/oss-security/2014/07/11/4 - http://jvn.jp/en/jp/JVN71730320/index.html - http://www.securityfocus.com/bid/68031 - http://framework.zend.com/security/advisory/ZF2014-04 - https://www.debian.org/security/2015/dsa
tyfocus.com/bid/68031 - http://framework.zend.com/security/advisory/ZF2014-04 - https://www.debian.org/security/2015/dsa-3265
CVE ID: CVE-2014-4919 State: PUBLISHED Published: 2018-01-19T15:00:00 Last Updated: 2024-08-06T11:34:36.090Z Vendors: n/a Products: n/a Problem Types: n/a Description: OXID eShop Professional Edition before 4.7.13 and 4.8.x before 4.8.7, Enterprise Edition before 5.0.13 and 5.1.x before 5.1.7, and Community Edition before 4.7.13 and 4.8.x before 4.8.7 allow remote attackers to assign users to arbitrary dynamical user groups. Additional Analyst Notes: - CVE Program Container: References: - https://oxidforge.org/en/security-bulletin-2014-003.html - https://bugs.oxid-esales.com/view.php?id=5814
CVE ID: CVE-2014-4925 State: PUBLISHED Published: 2017-08-28T15:00:00 Last Updated: 2024-08-06T11:34:36.573Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Good for Enterprise for Android 2.8.0.398 and 1.9.0.40. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/99893 - http://packetstormsecurity.com/files/129864/Good-For-Enterprise-Android-HTML-Injection.html - http://seclists.org/fulldisclosure/2015/Jan/17
CVE ID: CVE-2014-4927 State: PUBLISHED Published: 2014-07-24T14:00:00 Last Updated: 2024-08-06T11:34:36.159Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in ACME micro_httpd, as used in D-Link DSL2750U and DSL2740U and NetGear WGR614 and MR-ADSL-DG834 routers allows remote attackers to cause a denial of service (crash) via a long string in the URI in a GET request. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/34102 - http://www.securityfocus.com/bid/68746 - http://osvdb.org/show/osvdb/109356 - http://packetstormsecurity.com/files/127544/ACME-micro_httpd-Denial-Of-Service.html
CVE ID: CVE-2014-4928 State: PUBLISHED Published: 2018-03-20T21:00:00 Last Updated: 2024-08-06T11:34:36.158Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Invision Power Board (aka IPB or IP.Board) before 3.4.6 allows remote attackers to execute arbitrary SQL commands via the cId parameter. Additional Analyst Notes: - CVE Program Container: References: - http://dringen.blogspot.com.au/2014/07/invision-power-board-blind-sql.html
CVE ID: CVE-2014-4929 State: PUBLISHED Published: 2014-08-20T14:00:00 Last Updated: 2024-08-06T11:34:36.497Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the routing component in ownCloud Server before 5.0.17 and 6.0.x before 6.0.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in a filename, related to index.php. Additional Analyst Notes: - CVE Program Container: References: - http://advisories.mageia.org/MGASA-2014-0301.html - http://owncloud.org/security/advisory/?id=oc-sa-2014-018 - http://www.mandriva.com/security/advisories?name=MDVSA-2014:140 - http://www.securityfocus.com/bid/68975
CVE ID: CVE-2014-4930 State: PUBLISHED Published: 2014-08-29T14:00:00 Last Updated: 2024-08-06T11:34:36.090Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in event/index2.do in ManageEngine EventLog Analyzer before 9.0 build 9002 allow remote attackers to inject arbitrary web script or HTML via the (1) width, (2) height, (3) url, (4) helpP, (5) tab, (6) module, (7) completeData, (8) RBBNAME, (9) TC, (10) rtype, (11) eventCriteria, (12) q, (13) flushCache, or (14) product parameter. Fixed in Build 11072. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/69420 - http://seclists.org/
onal Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/69420 - http://seclists.org/fulldisclosure/2014/Aug/74 - http://packetstormsecurity.com/files/128012/ManageEngine-EventLog-Analyzer-7-Cross-Site-Scripting.html
CVE ID: CVE-2014-4932 State: PUBLISHED Published: 2018-08-28T17:00:00 Last Updated: 2024-08-06T11:34:36.609Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Wordfence Security plugin before 5.1.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the val parameter to whois.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/help/advanced/changelog/ - http://techdefencelabs.com/security-advisories.html
CVE ID: CVE-2014-4936 State: PUBLISHED Published: 2014-12-16T18:00:00 Last Updated: 2024-08-06T11:34:36.396Z Vendors: n/a Products: n/a Problem Types: n/a Description: The upgrade functionality in Malwarebytes Anti-Malware (MBAM) consumer before 2.0.3 and Malwarebytes Anti-Exploit (MBAE) consumer 1.04.1.1012 and earlier allow man-in-the-middle attackers to execute arbitrary code by spoofing the update server and uploading an executable. Additional Analyst Notes: - CVE Program Container: References: - http://blog.0x3a.com/post/104954032239/cve-2014-4936-malwarebytes-anti-malware-and - http://packetstormsecurity.com/files/130244/Malwarebytes-Anti-Malware-Anti-Exploit-Update-Remote-Code-Executi
ware-and - http://packetstormsecurity.com/files/130244/Malwarebytes-Anti-Malware-Anti-Exploit-Update-Remote-Code-Execution.html
CVE ID: CVE-2014-4937 State: PUBLISHED Published: 2014-07-11T20:00:00Z Last Updated: 2024-09-16T16:27:54.758Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in includes/bookx_export.php BookX plugin 1.7 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter. Additional Analyst Notes: - CVE Program Container: References: - http://codevigilant.com/disclosure/wp-plugin-bookx-local-file-inclusion/
CVE ID: CVE-2014-4938 State: PUBLISHED Published: 2014-07-11T20:00:00Z Last Updated: 2024-09-17T00:52:26.310Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the WP Rss Poster (wp-rss-poster) plugin 1.0.0 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter in the wrp-add-new page to wp-admin/admin.php. Additional Analyst Notes: - CVE Program Container: References: - http://codevigilant.com/disclosure/wp-plugin-wp-rss-poster-a1-injection/
CVE ID: CVE-2014-4939 State: PUBLISHED Published: 2014-07-11T20:00:00Z Last Updated: 2024-09-17T00:35:55.763Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the ENL Newsletter (enl-newsletter) plugin 1.0.1 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the id parameter in the enl-add-new page to wp-admin/admin.php. Additional Analyst Notes: - CVE Program Container: References: - http://codevigilant.com/disclosure/wp-plugin-enl-newsletter-a1-injection/
CVE ID: CVE-2014-4940 State: PUBLISHED Published: 2014-07-11T20:00:00Z Last Updated: 2024-09-16T19:25:02.588Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple directory traversal vulnerabilities in Tera Charts (tera-charts) plugin 0.1 for WordPress allow remote attackers to read arbitrary files via a .. (dot dot) in the fn parameter to (1) charts/treemap.php or (2) charts/zoomabletreemap.php. Additional Analyst Notes: - CVE Program Container: References: - http://codevigilant.com/disclosure/wp-plugin-tera-chart-local-file-inclusion/ - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=851874%40tera-charts&old=799253%40tera-charts&sfp_email=&sf
.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=851874%40tera-charts&old=799253%40tera-charts&sfp_email=&sfph_mail=
CVE ID: CVE-2014-4941 State: PUBLISHED Published: 2014-07-11T20:00:00Z Last Updated: 2024-09-17T03:27:39.131Z Vendors: n/a Products: n/a Problem Types: n/a Description: Absolute path traversal vulnerability in Cross-RSS (wp-cross-rss) plugin 1.7 for WordPress allows remote attackers to read arbitrary files via a full pathname in the rss parameter to proxy.php. Additional Analyst Notes: - CVE Program Container: References: - http://codevigilant.com/disclosure/wp-plugin-cross-rss-local-file-inclusion/
CVE ID: CVE-2014-4942 State: PUBLISHED Published: 2014-07-11T20:00:00Z Last Updated: 2024-09-16T20:13:13.868Z Vendors: n/a Products: n/a Problem Types: n/a Description: The EasyCart (wp-easycart) plugin before 2.0.6 for WordPress allows remote attackers to obtain configuration information via a direct request to inc/admin/phpinfo.php, which calls the phpinfo function. Additional Analyst Notes: - CVE Program Container: References: - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=829290%40wp-easycart&old=827627%40wp-easycart&sfp_email=&sfph_mail= - http://codevigilant.com/disclosure/wp-plugin-wp-easycart-information-disclosure/
CVE ID: CVE-2014-4943 State: PUBLISHED Published: 2014-07-19T19:00:00 Last Updated: 2024-08-06T11:34:36.396Z Vendors: n/a Products: n/a Problem Types: n/a Description: The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the Linux kernel through 3.15.6 allows local users to gain privileges by leveraging data-structure differences between an l2tp socket and an inet socket. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/36267 - http://linux.oracle.com/errata/ELSA-2014-3047.html - http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00006.html - http://www.securitytracker.com/id/1030610 - http://secunia.com/advisories/60220 - http://secu
ce/2014-10/msg00006.html - http://www.securitytracker.com/id/1030610 - http://secunia.com/advisories/60220 - http://secunia.com/advisories/59790 - http://rhn.redhat.com/errata/RHSA-2014-1025.html - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=3cf521f7dc87c031617fd47e4b7aa2593c2f3daf - http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00007.html - http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.html - http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.html - https://bugzilla.redhat.com/show_bug.cgi?id=1119458 - http://linux.oracle.com/errata/ELSA-2014-0924.html - http://secunia.com/advisories/60393 - htt
show_bug.cgi?id=1119458 - http://linux.oracle.com/errata/ELSA-2014-0924.html - http://secunia.com/advisories/60393 - http://secunia.com/advisories/60380 - http://linux.oracle.com/errata/ELSA-2014-3048.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/94665 - http://openwall.com/lists/oss-security/2014/07/17/1 - http://secunia.com/advisories/60011 - https://github.com/torvalds/linux/commit/3cf521f7dc87c031617fd47e4b7aa2593c2f3daf - http://www.debian.org/security/2014/dsa-2992 - http://osvdb.org/show/osvdb/109277 - http://secunia.com/advisories/60071
CVE ID: CVE-2014-4944 State: PUBLISHED Published: 2014-07-14T14:00:00Z Last Updated: 2024-09-16T19:14:49.772Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in inc/bsk-pdf-dashboard.php in the BSK PDF Manager plugin 1.3.2 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) categoryid or (2) pdfid parameter to wp-admin/admin.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/68488 - http://packetstormsecurity.com/files/127407/WordPress-BSK-PDF-Manager-1.3.2-SQL-Injection.html
CVE ID: CVE-2014-4945 State: PUBLISHED Published: 2014-07-14T14:00:00Z Last Updated: 2024-09-17T04:14:56.484Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Horde Internet Mail Program (IMP) before 6.1.8, as used in Horde Groupware Webmail Edition before 5.1.5, allow remote attackers to inject arbitrary web script or HTML via an unspecified flag in the basic (1) mailbox or (2) message view. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/59772 - http://lists.horde.org/archives/announce/2014/001025.html - http://secunia.com/advisories/59770 - https://github.com/horde/horde/blob/45
de.org/archives/announce/2014/001025.html - http://secunia.com/advisories/59770 - https://github.com/horde/horde/blob/4513649810f13a32f1193bdeed76f7d85a5efa05/bundles/webmail/docs/CHANGES - https://github.com/horde/horde/blob/c0144ac03814a8c2cf6fc5ac0d1af2653e9ee139/imp/docs/CHANGES - http://lists.horde.org/archives/announce/2014/001019.html
CVE ID: CVE-2014-4946 State: PUBLISHED Published: 2014-07-14T14:00:00Z Last Updated: 2024-09-17T03:03:19.100Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Horde Internet Mail Program (IMP) before 6.1.8, as used in Horde Groupware Webmail Edition before 5.1.5, allow remote attackers to inject arbitrary web script or HTML via (1) unspecified flags or (2) a mailbox name in the dynamic mailbox view. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/59772 - http://lists.horde.org/archives/announce/2014/001025.html - http://secunia.com/advisories/59770 - https://github.com/horde/horde/
sts.horde.org/archives/announce/2014/001025.html - http://secunia.com/advisories/59770 - https://github.com/horde/horde/blob/4513649810f13a32f1193bdeed76f7d85a5efa05/bundles/webmail/docs/CHANGES - https://github.com/horde/horde/blob/c0144ac03814a8c2cf6fc5ac0d1af2653e9ee139/imp/docs/CHANGES - http://lists.horde.org/archives/announce/2014/001019.html
CVE ID: CVE-2014-4947 State: PUBLISHED Published: 2014-07-22T20:00:00 Last Updated: 2024-08-06T11:34:36.611Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the HVM graphics console support in Citrix XenServer 6.2 Service Pack 1 and earlier has unspecified impact and attack vectors. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/60027 - http://www.securitytracker.com/id/1030604 - http://support.citrix.com/article/CTX140984 - https://exchange.xforce.ibmcloud.com/vulnerabilities/94631 - http://www.securityfocus.com/bid/68659
CVE ID: CVE-2014-4948 State: PUBLISHED Published: 2014-07-22T20:00:00 Last Updated: 2024-08-06T11:34:36.523Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in Citrix XenServer 6.2 Service Pack 1 and earlier allows attackers to cause a denial of service and obtain sensitive information by modifying the guest virtual hard disk (VHD). Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/94632 - http://secunia.com/advisories/60027 - http://www.securitytracker.com/id/1030604 - http://support.citrix.com/article/CTX140984 - http://www.securityfocus.com/bid/68660
CVE ID: CVE-2014-4949 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2014-4950 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2014-4951 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2014-4952 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2014-4953 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2014-4954 State: PUBLISHED Published: 2014-07-20T10:00:00 Last Updated: 2024-08-06T11:34:37.234Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the PMA_getHtmlForActionLinks function in libraries/structure.lib.php in phpMyAdmin 4.2.x before 4.2.6 allows remote authenticated users to inject arbitrary web script or HTML via a crafted table comment that is improperly handled during construction of a database structure page. Additional Analyst Notes: - CVE Program Container: References: - http://www.phpmyadmin.net/home_page/security/PMASA-2014-4.php - http://www.securityfocus.com/bid/68798 - https://github.com/phpmyadmin/phpmyad
net/home_page/security/PMASA-2014-4.php - http://www.securityfocus.com/bid/68798 - https://github.com/phpmyadmin/phpmyadmin/commit/57475371a5b515c83bfc1bb2efcdf3ddb14787ed
CVE ID: CVE-2014-4955 State: PUBLISHED Published: 2014-07-20T10:00:00 Last Updated: 2024-08-06T11:34:36.563Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the PMA_TRI_getRowForList function in libraries/rte/rte_list.lib.php in phpMyAdmin 4.0.x before 4.0.10.1, 4.1.x before 4.1.14.2, and 4.2.x before 4.2.6 allows remote authenticated users to inject arbitrary web script or HTML via a crafted trigger name that is improperly handled on the database triggers page. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html - http://www.securityfocus.com/bid/68799 - https
ces: - http://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html - http://www.securityfocus.com/bid/68799 - https://github.com/phpmyadmin/phpmyadmin/commit/10014d4dc596b9e3a491bf04f3e708cf1887d5e1 - http://www.phpmyadmin.net/home_page/security/PMASA-2014-5.php - http://secunia.com/advisories/60397
CVE ID: CVE-2014-4958 State: PUBLISHED Published: 2014-09-26T21:00:00 Last Updated: 2024-08-06T11:34:36.802Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Telerik UI for ASP.NET AJAX RadEditor control 2014.1.403.35, 2009.3.1208.20, and other versions allows remote attackers to inject arbitrary web script or HTML via CSS expressions in style attributes. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/128414/Telerik-ASP.NET-AJAX-RadEditor-Control-2014.1.403.35-XSS.html - http://www.securityfocus.com/archive/1/533537/30/0/threaded - http://maverickblogging.com/disclosing-cve-2014-4958-
ml - http://www.securityfocus.com/archive/1/533537/30/0/threaded - http://maverickblogging.com/disclosing-cve-2014-4958-stored-attribute-based-cross-site-scripting-xss-vulnerability-in-telerik-ui-for-asp-net-ajax-radeditor-control/ - http://blogs.telerik.com/blogs/14-09-24/securing-radeditor-content-and-preventing-xss-attacks
CVE ID: CVE-2014-4959 State: PUBLISHED Published: 2018-03-27T16:00:00 Last Updated: 2024-08-06T11:34:37.158Z Vendors: n/a Products: n/a Problem Types: n/a Description: **DISPUTED** SQL injection vulnerability in SQLiteDatabase.java in the SQLi Api in Android allows remote attackers to execute arbitrary SQL commands via the delete method. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/68912 - http://packetstormsecurity.com/files/127651/Android-SDK-SQL-Injection.html - http://seclists.org/fulldisclosure/2014/Jul/138 - http://seclists.org/fulldisclosure/2014/Jul/139
CVE ID: CVE-2014-4960 State: PUBLISHED Published: 2014-07-21T14:00:00 Last Updated: 2024-08-06T11:34:36.530Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in models\gallery.php in Youtube Gallery (com_youtubegallery) component 4.x through 4.1.7, and possibly 3.x, for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) listid or (2) themeid parameter to index.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/68676 - http://packetstormsecurity.com/files/127497/Joomla-Youtube-Gallery-4.1.7-SQL-Injection.html - http://www.exploit-db.com/exploits/34087
CVE ID: CVE-2014-4962 State: PUBLISHED Published: 2014-07-15T14:00:00 Last Updated: 2024-08-06T11:34:36.730Z Vendors: n/a Products: n/a Problem Types: n/a Description: Shopizer 1.1.5 and earlier allows remote attackers to reduce the total cost of their shopping cart via a negative number in the productQuantity parameter, which causes the price of the item to be subtracted from the total cost. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/532726/100/0/threaded - http://seclists.org/fulldisclosure/2014/Jul/38
CVE ID: CVE-2014-4963 State: PUBLISHED Published: 2014-07-15T14:00:00 Last Updated: 2024-08-06T11:34:36.553Z Vendors: n/a Products: n/a Problem Types: n/a Description: Shopizer 1.1.5 and earlier allows remote attackers to modify the account settings of arbitrary users via the customer.customerId parameter to shop/profile/register.action. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/532726/100/0/threaded - http://seclists.org/fulldisclosure/2014/Jul/38
CVE ID: CVE-2014-4964 State: PUBLISHED Published: 2014-07-15T14:00:00 Last Updated: 2024-08-06T11:34:36.886Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Shopizer 1.1.5 and earlier allow remote attackers to hijack the authentication of users for requests that (1) modify customer settings or hijack the authentication of administrators for requests that change (2) customer passwords, (3) shop configuration, or (4) product details, as demonstrated by (5) modify a product's price via a crafted request to central/catalog/saveproduct.action or (6) creating a product review via a crafted request to shop/product/createReview
o central/catalog/saveproduct.action or (6) creating a product review via a crafted request to shop/product/createReview.action. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/532726/100/0/threaded - http://seclists.org/fulldisclosure/2014/Jul/38
CVE ID: CVE-2014-4965 State: PUBLISHED Published: 2014-07-15T14:00:00 Last Updated: 2024-08-06T11:34:36.518Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Shopizer 1.1.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) customername parameter to central/orders/searchcriteria.action; (2) productname, (3) availability, or (4) status parameter to central/catalog/productlist.action; or unspecified vectors in (5) WebContent/orders/orderlist.jsp. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/532726/100/0/threaded - http://seclists.org/ful
Program Container: References: - http://www.securityfocus.com/archive/1/532726/100/0/threaded - http://seclists.org/fulldisclosure/2014/Jul/38 - https://exchange.xforce.ibmcloud.com/vulnerabilities/94465
CVE ID: CVE-2014-4966 State: PUBLISHED Published: 2020-02-18T14:46:28 Last Updated: 2024-08-06T11:34:36.779Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ansible before 1.6.7 does not prevent inventory data with "{{" and "lookup" substrings, and does not prevent remote data with "{{" substrings, which allows remote attackers to execute arbitrary code via (1) crafted lookup('pipe') calls or (2) crafted Jinja2 data. Additional Analyst Notes: - CVE Program Container: References: - http://www.ocert.org/advisories/ocert-2014-004.html - https://github.com/ansible/ansible/commit/62a1295a3e08cb6c3e9f1b2a1e6e5dcaeab32527