Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2014-5100 State: PUBLISHED Published: 2014-07-25T19:00:00 Last Updated: 2024-08-06T11:34:37.304Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Omeka before 2.2.1 allow remote attackers to hijack the authentication of administrators for requests that (1) add a new super user account via a request to admin/users/add, (2) insert cross-site scripting (XSS) sequences via the api_key_label parameter to admin/users/api-keys/1, or (3) disable file validation via a request to admin/settings/edit-security. Additional Analyst Notes: - CVE Program Container: References: - http://omeka.org/codex/Release_Notes_for_2.2.1
ecurity. Additional Analyst Notes: - CVE Program Container: References: - http://omeka.org/codex/Release_Notes_for_2.2.1 - https://exchange.xforce.ibmcloud.com/vulnerabilities/94689 - https://exchange.xforce.ibmcloud.com/vulnerabilities/94690 - http://www.securityfocus.com/bid/68707 - http://www.exploit-db.com/exploits/34100 - http://packetstormsecurity.com/files/127523/Omeka-2.2-Cross-Site-Request-Forgery-Cross-Site-Scripting.html - http://www.zeroscience.mk/codes/omeka_csrfxss.txt - http://omeka.org/blog/2014/07/16/omeka-2-2-1-security-update-released - http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5193.php
CVE ID: CVE-2014-5101 State: PUBLISHED Published: 2014-07-25T19:00:00Z Last Updated: 2024-09-16T18:33:42.389Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in WeBid 1.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) TPL_name, (2) TPL_nick, (3) TPL_email, (4) TPL_year, (5) TPL_address, (6) TPL_city, (7) TPL_prov, (8) TPL_zip, (9) TPL_phone, (10) TPL_pp_email, (11) TPL_authnet_id, (12) TPL_authnet_pass, (13) TPL_worldpay_id, (14) TPL_toocheckout_id, or (15) TPL_moneybookers_email in a first action to register.php or the (16) username parameter in a login action to user_login.php. Additional Analyst No
a first action to register.php or the (16) username parameter in a login action to user_login.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/68519 - http://packetstormsecurity.com/files/127431/WeBid-1.1.1-Cross-Site-Scripting-LDAP-Injection.html
CVE ID: CVE-2014-5102 State: PUBLISHED Published: 2014-07-25T19:00:00 Last Updated: 2024-08-06T11:34:37.268Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in vBulletin 5.0.4 through 5.1.3 Alpha 5 allows remote attackers to execute arbitrary SQL commands via the criteria[startswith] parameter to ajax/render/memberlist_items. Additional Analyst Notes: - CVE Program Container: References: - http://www.pcworld.com/article/2455500/emergency-vbulletin-patch-fixes-dangerous-sql-injection-vulnerability.html - http://www.securityfocus.com/bid/68709 - http://www.vbulletin.com/forum/forum/vbulletin-announcements/vbulletin-announcements_aa/4097503-security-patch-
/68709 - http://www.vbulletin.com/forum/forum/vbulletin-announcements/vbulletin-announcements_aa/4097503-security-patch-release-for-vbulletin-5-0-4-5-0-5-5-1-0-5-1-1-and-5-1-2 - http://packetstormsecurity.com/files/127537/vBulletin-5.1.2-SQL-Injection.html
CVE ID: CVE-2014-5103 State: PUBLISHED Published: 2014-07-25T19:00:00 Last Updated: 2024-08-06T11:34:37.310Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in ZOHO ManageEngine EventLog Analyzer 9 build 9000 allows remote attackers to inject arbitrary web script or HTML via the j_username parameter to event/j_security_check. Fixed in Version 10 Build 10000. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/532856/100/0/threaded - http://packetstormsecurity.com/files/127568/EventLog-Analyzer-9.0-Build-9000-Cross-Site-Scripting.html - http://www.securityfocus.com/bid/68854
CVE ID: CVE-2014-5104 State: PUBLISHED Published: 2014-07-28T15:00:00Z Last Updated: 2024-09-16T19:30:54.686Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in ol-commerce 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) a_country parameter in a process action to affiliate_signup.php, (2) affiliate_banner_id parameter to affiliate_show_banner.php, (3) country parameter in a process action to create_account.php, or (4) entry_country_id parameter in an edit action to admin/create_account.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/127521/OL-Commerce-2.1.1-
nal Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/127521/OL-Commerce-2.1.1-Cross-Site-Scripting-SQL-Injection.html - http://www.securityfocus.com/bid/68719
CVE ID: CVE-2014-5105 State: PUBLISHED Published: 2014-07-28T15:00:00Z Last Updated: 2024-09-17T02:42:18.417Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in ol-commerce 2.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) a_country parameter in a process action to affiliate_signup.php or (2) entry_country_id parameter in an edit action to admin/create_account.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/127521/OL-Commerce-2.1.1-Cross-Site-Scripting-SQL-Injection.html - http://www.securityfocus.com/bid/68719
CVE ID: CVE-2014-5106 State: PUBLISHED Published: 2014-07-28T15:00:00 Last Updated: 2024-08-06T11:34:37.239Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Invision Power IP.Board (aka IPB or Power Board) 3.4.x through 3.4.6 allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header to admin/install/index.php. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/94693 - http://www.securityfocus.com/archive/1/532822/100/0/threaded - http://www.securityfocus.com/bid/68705
CVE ID: CVE-2014-5107 State: PUBLISHED Published: 2014-07-28T15:00:00Z Last Updated: 2024-09-17T02:37:35.127Z Vendors: n/a Products: n/a Problem Types: n/a Description: concrete5 before 5.6.3 allows remote attackers to obtain the installation path via a direct request to (1) system/basics/editor.php, (2) system/view.php, (3) system/environment/file_storage_locations.php, (4) system/mail/importers.php, (5) system/mail/method.php, (6) system/permissions/file_types.php, (7) system/permissions/files.php, (8) system/permissions/tasks.php, (9) system/permissions/users.php, (10) system/seo/view.php, (11) view.php, (12) users/attributes.php, (13) scrapbook/view.php, (14) pages/attributes.php, (15) f
ystem/seo/view.php, (11) view.php, (12) users/attributes.php, (13) scrapbook/view.php, (14) pages/attributes.php, (15) files/attributes.php, or (16) files/search.php in single_pages/dashboard/. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/68685 - http://osvdb.org/show/osvdb/109269 - http://packetstormsecurity.com/files/127493/Concrete-5.6.2.1-REFERER-Cross-Site-Scripting.html - https://www.concrete5.org/documentation/background/version_history/5-6-3-release-notes
CVE ID: CVE-2014-5108 State: PUBLISHED Published: 2014-07-28T15:00:00Z Last Updated: 2024-09-16T22:46:39.092Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in single_pages\download_file.php in concrete5 before 5.6.3 allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header to index.php/download_file. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/68685 - http://packetstormsecurity.com/files/127493/Concrete-5.6.2.1-REFERER-Cross-Site-Scripting.html - https://www.concrete5.org/documentation/background/version_history/5-6-3-release-notes - http://osvdb.org/sh
ting.html - https://www.concrete5.org/documentation/background/version_history/5-6-3-release-notes - http://osvdb.org/show/osvdb/109273
CVE ID: CVE-2014-5109 State: PUBLISHED Published: 2014-07-28T15:00:00 Last Updated: 2024-08-06T11:34:37.293Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in maint/modules/endpointcfg/endpoint_generic.php in Fonality trixbox allows remote attackers to execute arbitrary SQL commands via the mac parameter in a Submit action. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/94718 - http://packetstormsecurity.com/files/127522/Trixbox-XSS-LFI-SQL-Injection-Code-Execution.html
CVE ID: CVE-2014-5110 State: PUBLISHED Published: 2014-07-28T15:00:00 Last Updated: 2024-08-06T11:34:37.233Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in user/help/html/index.php in Fonality trixbox allows remote attackers to inject arbitrary web script or HTML via the id_nodo parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/94719 - http://packetstormsecurity.com/files/127522/Trixbox-XSS-LFI-SQL-Injection-Code-Execution.html
CVE ID: CVE-2014-5111 State: PUBLISHED Published: 2014-07-28T15:00:00Z Last Updated: 2024-09-16T19:51:36.059Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple directory traversal vulnerabilities in Fonality trixbox allow remote attackers to read arbitrary files via a .. (dot dot) in the lang parameter to (1) home/index.php, (2) asterisk_info/asterisk_info.php, (3) repo/repo.php, or (4) endpointcfg/endpointcfg.php in maint/modules/. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/127522/Trixbox-XSS-LFI-SQL-Injection-Code-Execution.html
CVE ID: CVE-2014-5112 State: PUBLISHED Published: 2014-07-28T15:00:00Z Last Updated: 2024-09-16T17:48:10.374Z Vendors: n/a Products: n/a Problem Types: n/a Description: maint/modules/home/index.php in Fonality trixbox allows remote attackers to execute arbitrary commands via shell metacharacters in the lang parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/127522/Trixbox-XSS-LFI-SQL-Injection-Code-Execution.html
CVE ID: CVE-2014-5113 State: PUBLISHED Published: 2014-07-28T15:00:00Z Last Updated: 2024-09-16T16:28:49.848Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in test.php in Visualware MyConnection Server 9.7i allow remote attackers to inject arbitrary web script or HTML via the (1) testtype, (2) ver, (3) cm, (4) map, (5) lines, (6) pps, (7) bpp, (8) codec, (9) provtext, (10) provtextextra, (11) provlink, or (12) duration parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/127545/MyConnection-Server-MCS-9.7i-Cross-Site-Scripting.html - http://www.securityfocus.com/bid/68
rmsecurity.com/files/127545/MyConnection-Server-MCS-9.7i-Cross-Site-Scripting.html - http://www.securityfocus.com/bid/68793 - http://treadstonesecurity.blogspot.ca/2014/07/myconnection-server-mcs-reflective-xss.html
CVE ID: CVE-2014-5114 State: PUBLISHED Published: 2014-07-29T14:00:00Z Last Updated: 2024-09-17T03:13:47.249Z Vendors: n/a Products: n/a Problem Types: n/a Description: WeBid 1.1.1 allows remote attackers to conduct an LDAP injection attack via the (1) js or (2) cat parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/68519 - http://packetstormsecurity.com/files/127431/WeBid-1.1.1-Cross-Site-Scripting-LDAP-Injection.html
CVE ID: CVE-2014-5115 State: PUBLISHED Published: 2014-07-29T14:00:00 Last Updated: 2024-08-06T11:34:37.423Z Vendors: n/a Products: n/a Problem Types: n/a Description: Absolute path traversal vulnerability in DirPHP 1.0 allows remote attackers to read arbitrary files via a full pathname in the phpfile parameter to index.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/34173 - http://packetstormsecurity.com/files/127642/DirPHP-1.0-Local-File-Inclusion.html
CVE ID: CVE-2014-5116 State: PUBLISHED Published: 2014-07-29T14:00:00Z Last Updated: 2024-09-16T16:52:45.612Z Vendors: n/a Products: n/a Problem Types: n/a Description: The cairo_image_surface_get_data function in Cairo 1.10.2, as used in GTK+ and Wireshark, allows context-dependent attackers to cause a denial of service (NULL pointer dereference) via a large string. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/33384 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9761 - http://www.osvdb.org/107083
CVE ID: CVE-2014-5117 State: PUBLISHED Published: 2014-07-30T16:00:00 Last Updated: 2024-08-06T11:34:37.419Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tor before 0.2.4.23 and 0.2.5 before 0.2.5.6-alpha maintains a circuit after an inbound RELAY_EARLY cell is received by a client, which makes it easier for remote attackers to conduct traffic-confirmation attacks by using the pattern of RELAY and RELAY_EARLY cells as a means of communicating information about hidden service names. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/60084 - https://trac.torproject.org/projects/tor/ticket/1038 - http://secunia.com/advisories/60647 - htt
.com/advisories/60084 - https://trac.torproject.org/projects/tor/ticket/1038 - http://secunia.com/advisories/60647 - https://blog.torproject.org/blog/tor-security-advisory-relay-early-traffic-confirmation-attack - https://lists.torproject.org/pipermail/tor-talk/2014-July/034180.html - https://lists.torproject.org/pipermail/tor-announce/2014-July/000094.html - https://lists.torproject.org/pipermail/tor-announce/2014-July/000093.html
CVE ID: CVE-2014-5118 State: PUBLISHED Published: 2019-11-18T22:03:43 Last Updated: 2024-08-06T11:34:37.210Z Vendors: n/a Products: n/a Problem Types: n/a Description: Trusted Boot (tboot) before 1.8.2 has a 'loader.c' Security Bypass Vulnerability Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/68960 - https://exchange.xforce.ibmcloud.com/vulnerabilities/95063 - http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136768.html - http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136778.html - http://www.openwall.com/lists/oss-security/2014/07/30/4
CVE ID: CVE-2014-5119 State: PUBLISHED Published: 2014-08-29T17:00:00 Last Updated: 2024-08-06T11:34:37.416Z Vendors: n/a Products: n/a Problem Types: n/a Description: Off-by-one error in the __gconv_translit_find function in gconv_trans.c in GNU C Library (aka glibc) allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via vectors related to the CHARSET environment variable and gconv transliteration modules. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/60441 - http://www.openwall.com/lists/oss-security/2014/08/13/5 - http://www.securityfocus.com/bid/69738 - http://rhn.redhat.com/errata/RHSA-2014-1
.com/lists/oss-security/2014/08/13/5 - http://www.securityfocus.com/bid/69738 - http://rhn.redhat.com/errata/RHSA-2014-1118.html - https://rhn.redhat.com/errata/RHSA-2014-1110.html - http://www-01.ibm.com/support/docview.wss?uid=swg21685604 - http://secunia.com/advisories/60345 - http://secunia.com/advisories/61093 - https://security.gentoo.org/glsa/201602-02 - http://www.mandriva.com/security/advisories?name=MDVSA-2014:175 - http://googleprojectzero.blogspot.com/2014/08/the-poisoned-nul-byte-2014-edition.html - http://www.openwall.com/lists/oss-security/2014/07/14/1 - http://www.securityfocus.com/bid/68983 - https://sourceware.org/bugzilla/show_bug.cgi?id=17187 - https://code.google.com/p/g
://www.securityfocus.com/bid/68983 - https://sourceware.org/bugzilla/show_bug.cgi?id=17187 - https://code.google.com/p/google-security-research/issues/detail?id=96 - http://seclists.org/fulldisclosure/2014/Aug/69 - http://www.debian.org/security/2014/dsa-3012 - http://secunia.com/advisories/61074 - http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-5119 - http://linux.oracle.com/errata/ELSA-2015-0092.html - http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00017.html - http://secunia.com/advisories/60358
CVE ID: CVE-2014-5120 State: PUBLISHED Published: 2014-08-23T01:00:00 Last Updated: 2024-08-06T11:34:37.424Z Vendors: n/a Products: n/a Problem Types: n/a Description: gd_ctx.c in the GD component in PHP 5.4.x before 5.4.32 and 5.5.x before 5.5.16 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to overwrite arbitrary files via crafted input to an application that calls the (1) imagegd, (2) imagegd2, (3) imagegif, (4) imagejpeg, (5) imagepng, (6) imagewbmp, or (7) imagewebp function. Additional Analyst Notes: - CVE Program Container: References: - https://support.apple.com/HT204659 - http://rhn.redhat.com/errata/RHSA-2014-1766.html - https://bugs.php.net/
erences: - https://support.apple.com/HT204659 - http://rhn.redhat.com/errata/RHSA-2014-1766.html - https://bugs.php.net/bug.php?id=67730 - http://php.net/ChangeLog-5.php - http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html - http://rhn.redhat.com/errata/RHSA-2014-1327.html - http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html - http://rhn.redhat.com/errata/RHSA-2014-1765.html - http://lists.opensuse.org/opensuse-updates/2014-09/msg00024.html
CVE ID: CVE-2014-5121 State: PUBLISHED Published: 2014-08-22T14:00:00 Last Updated: 2024-08-06T11:34:37.437Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in ESRI ArcGIS for Server 10.1.1 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/127959/ArcGIS-For-Server-10.1.1-XSS-Open-Redirect.html - http://www.securityfocus.com/archive/1/533189/100/0/threaded - http://www.securitytracker.com/id/1030752
CVE ID: CVE-2014-5122 State: PUBLISHED Published: 2014-08-22T14:00:00 Last Updated: 2024-08-06T11:34:37.321Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open redirect vulnerability in ESRI ArcGIS for Server 10.1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via an unspecified parameter, related to login. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/69341 - http://packetstormsecurity.com/files/127959/ArcGIS-For-Server-10.1.1-XSS-Open-Redirect.html - http://www.securityfocus.com/archive/1/533189/100/0/threaded - http://www.securitytracker.com/id/1030752
CVE ID: CVE-2014-5127 State: PUBLISHED Published: 2014-08-29T14:00:00 Last Updated: 2024-08-06T11:34:37.409Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open redirect vulnerability in Innovative Interfaces Encore Discovery Solution 4.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in an unspecified parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/95568 - http://packetstormsecurity.com/files/128013/Encore-Discovery-Solution-4.3-Open-Redirect-Session-Token-In-URL.html - http://www.securityfocus.com/archive/1/533233/100/0/threaded - http://www.
4.3-Open-Redirect-Session-Token-In-URL.html - http://www.securityfocus.com/archive/1/533233/100/0/threaded - http://www.securityfocus.com/bid/69427
CVE ID: CVE-2014-5128 State: PUBLISHED Published: 2014-08-29T14:00:00 Last Updated: 2024-08-06T11:34:37.254Z Vendors: n/a Products: n/a Problem Types: n/a Description: Innovative Interfaces Encore Discovery Solution 4.3 places a session token in the URI, which might allow remote attackers to obtain sensitive information via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/128013/Encore-Discovery-Solution-4.3-Open-Redirect-Session-Token-In-URL.html - http://www.securityfocus.com/archive/1/533233/100/0/threaded - https://exchange.xforce.ibmcloud.com/vulnerabilities/95570 - http://www.securityfocus.com/bid/69431
CVE ID: CVE-2014-5129 State: PUBLISHED Published: 2014-09-11T15:00:00 Last Updated: 2024-08-06T11:34:37.346Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Avolve Software ProjectDox 8.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/533345/100/0/threaded - http://packetstormsecurity.com/files/128157/ProjectDox-8.1-XSS-User-Enumeration-Ciphertext-Reuse.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/95734
CVE ID: CVE-2014-5130 State: PUBLISHED Published: 2018-03-27T21:00:00 Last Updated: 2024-08-06T11:34:37.316Z Vendors: n/a Products: n/a Problem Types: n/a Description: Avolve Software ProjectDox 8.1 allows remote authenticated users to obtain sensitive information from other users via vectors involving a direct access token. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/69621 - http://www.securityfocus.com/archive/1/533345/100/0/threaded - https://exchange.xforce.ibmcloud.com/vulnerabilities/95735 - http://packetstormsecurity.com/files/128157/ProjectDox-8.1-XSS-User-Enumeration-Ciphertext-Reuse.html
CVE ID: CVE-2014-5131 State: PUBLISHED Published: 2018-03-27T21:00:00 Last Updated: 2024-08-06T11:34:37.410Z Vendors: n/a Products: n/a Problem Types: n/a Description: Avolve Software ProjectDox 8.1 makes it easier for remote authenticated users to obtain sensitive information by leveraging ciphertext reuse. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/533345/100/0/threaded - https://exchange.xforce.ibmcloud.com/vulnerabilities/95736 - http://packetstormsecurity.com/files/128157/ProjectDox-8.1-XSS-User-Enumeration-Ciphertext-Reuse.html - http://www.securityfocus.com/bid/69632
CVE ID: CVE-2014-5132 State: PUBLISHED Published: 2018-03-27T21:00:00 Last Updated: 2024-08-06T11:34:37.428Z Vendors: n/a Products: n/a Problem Types: n/a Description: Avolve Software ProjectDox 8.1 allows remote attackers to enumerate users via vectors related to email addresses. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/95737 - http://www.securityfocus.com/archive/1/533345/100/0/threaded - http://packetstormsecurity.com/files/128157/ProjectDox-8.1-XSS-User-Enumeration-Ciphertext-Reuse.html
CVE ID: CVE-2014-5136 State: PUBLISHED Published: 2014-09-02T14:00:00 Last Updated: 2024-08-06T11:34:37.412Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Innovative Interfaces Sierra Library Services Platform 1.2_3 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/533267/100/0/threaded - http://www.securityfocus.com/bid/69466
CVE ID: CVE-2014-5137 State: PUBLISHED Published: 2014-09-02T14:00:00 Last Updated: 2024-08-06T11:34:37.411Z Vendors: n/a Products: n/a Problem Types: n/a Description: Innovative Interfaces Sierra Library Services Platform 1.2_3 provides different responses for login request depending on whether the user account exists, which allows remote attackers to enumerate account names via a series of login requests, possibly related to the Webpac Pro submodule. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/533267/100/0/threaded