Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2014-5356 State: PUBLISHED Published: 2014-08-25T14:00:00 Last Updated: 2024-08-06T11:41:49.236Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenStack Image Registry and Delivery Service (Glance) before 2013.2.4, 2014.x before 2014.1.3, and Juno before Juno-3, when using the V2 API, does not properly enforce the image_size_cap configuration option, which allows remote authenticated users to cause a denial of service (disk consumption) by uploading a large image. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2014/08/21/6 - http://www.ubuntu.com/usn/USN-2322-1 - http://rhn.redhat.com/errata/RHSA-2014-1337.
om/lists/oss-security/2014/08/21/6 - http://www.ubuntu.com/usn/USN-2322-1 - http://rhn.redhat.com/errata/RHSA-2014-1337.html - http://rhn.redhat.com/errata/RHSA-2014-1685.html - http://secunia.com/advisories/60743 - https://bugs.launchpad.net/glance/+bug/1315321 - http://rhn.redhat.com/errata/RHSA-2014-1338.html
CVE ID: CVE-2014-5359 State: PUBLISHED Published: 2014-12-16T18:00:00 Last Updated: 2024-08-06T11:41:48.993Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in SafeNet Authentication Service (SAS) Outlook Web Access Agent (formerly CRYPTOCard) before 1.03.30109 allows remote attackers to read arbitrary files via a .. (dot dot) in the GetFile parameter to owa/owa. Additional Analyst Notes: - CVE Program Container: References: - http://www.safenet-inc.com/technical-support/security-updates/ - http://appcheck-ng.com/safenet-sas-owa-agent-directory-traversal-vulnerability/
CVE ID: CVE-2014-5360 State: PUBLISHED Published: 2015-02-03T16:00:00 Last Updated: 2024-08-06T11:41:49.152Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the admin interface in LANDESK Management Suite before 9.6 SP1 allows remote attackers to inject arbitrary web script or HTML via the AMTVersion parameter to remote/serverlist_grouptree.aspx. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2015/Feb/6
CVE ID: CVE-2014-5361 State: PUBLISHED Published: 2015-04-21T15:00:00 Last Updated: 2024-08-06T11:41:48.809Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Landesk Management Suite 9.6 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) start, (2) stop, or (3) restart services via a request to remote/serverServices.aspx. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/131496/Landesk-Management-Suite-9.5-RFI-CSRF.html - http://www.securityfocus.com/archive/1/535286/100/0/threaded
CVE ID: CVE-2014-5362 State: PUBLISHED Published: 2017-09-19T15:00:00 Last Updated: 2024-08-06T11:41:49.212Z Vendors: n/a Products: n/a Problem Types: n/a Description: The admin interface in Landesk Management Suite 9.6 and earlier allows remote attackers to conduct remote file inclusion attacks involving ASPX pages from third-party sites via the d parameter to (1) ldms/sm_actionfrm.asp or (2) remote/frm_coremainfrm.aspx; or the (3) top parameter to remote/frm_splitfrm.aspx. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1032203 - http://www.securityfocus.com/archive/1/535286/100/1100/threaded - http://www.securityfocus.com/bid/74190 - http
032203 - http://www.securityfocus.com/archive/1/535286/100/1100/threaded - http://www.securityfocus.com/bid/74190 - http://packetstormsecurity.com/files/131496/Landesk-Management-Suite-9.5-RFI-CSRF.html
CVE ID: CVE-2014-5367 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2021-01-06T16:16:03 Description: No description available.
CVE ID: CVE-2014-5368 State: PUBLISHED Published: 2014-08-22T14:00:00 Last Updated: 2024-08-06T11:41:49.304Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the file_get_contents function in downloadfiles/download.php in the WP Content Source Control (wp-source-control) plugin 3.0.0 and earlier for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the path parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/69278 - http://seclists.org/oss-sec/2014/q3/417 - http://seclists.org/oss-sec/2014/q3/407 - https://exchange.xforce.ibmcloud.com/vulnerabilities/95374
CVE ID: CVE-2014-5369 State: PUBLISHED Published: 2014-09-08T14:00:00 Last Updated: 2024-08-06T11:41:49.159Z Vendors: n/a Products: n/a Problem Types: n/a Description: Enigmail 1.7.x before 1.7.2 sends emails in plaintext when encryption is enabled and only BCC recipients are specified, which allows remote attackers to obtain sensitive information by sniffing the network. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-updates/2014-09/msg00008.html - http://secunia.com/advisories/60779 - http://sourceforge.net/p/enigmail/forum/support/thread/3e7268a4/ - http://secunia.com/advisories/60887 - https://advisories.mageia.org/MGASA-2014-0421.html
orum/support/thread/3e7268a4/ - http://secunia.com/advisories/60887 - https://advisories.mageia.org/MGASA-2014-0421.html - https://security.gentoo.org/glsa/201504-01 - http://sourceforge.net/p/enigmail/bugs/294/ - http://lists.opensuse.org/opensuse-updates/2014-09/msg00004.html - http://www.openwall.com/lists/oss-security/2014/08/22/1 - http://www.openwall.com/lists/oss-security/2014/08/18/2 - http://secunia.com/advisories/61854
CVE ID: CVE-2014-5370 State: PUBLISHED Published: 2015-04-21T15:00:00 Last Updated: 2024-08-06T11:41:49.150Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the CFChart servlet (com.naryx.tagfusion.cfm.cfchartServlet) in New Atlanta BlueDragon before 7.1.1.18527 allows remote attackers to read or possibly delete arbitrary files via a .. (dot dot) in the QUERY_STRING to cfchart.cfchart. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/131504/BlueDragon-CFChart-Servlet-7.1.1.17759-Directory-Traversal.html - http://seclists.org/fulldisclosure/2015/Apr/49 - https://www.portcullis-security.com/sec
7759-Directory-Traversal.html - http://seclists.org/fulldisclosure/2015/Apr/49 - https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-5370/ - https://www.exploit-db.com/exploits/36815/ - http://www.osvdb.org/119527
CVE ID: CVE-2014-5375 State: PUBLISHED Published: 2014-10-08T19:00:00 Last Updated: 2024-08-06T11:41:49.057Z Vendors: n/a Products: n/a Problem Types: n/a Description: The server in Adaptive Computing Moab before 7.2.9 and 8 before 8.0.0 does not properly validate the message owner matches the submitting user, which allows remote authenticated users to impersonate arbitrary users via the UserId and Owner tags. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/533576/100/0/threaded - http://www.adaptivecomputing.com/security-advisory/ - http://www.securityfocus.com/bid/70174 - http://packetstormsecurity.com/files/128484/Moab-User-Impersona
ity-advisory/ - http://www.securityfocus.com/bid/70174 - http://packetstormsecurity.com/files/128484/Moab-User-Impersonation.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/96698
CVE ID: CVE-2014-5376 State: PUBLISHED Published: 2014-10-08T19:00:00 Last Updated: 2024-08-06T11:41:49.298Z Vendors: n/a Products: n/a Problem Types: n/a Description: Adaptive Computing Moab before 7.2.9 and 8 before 8.0.0, when a pre-generated key is used, does not validate that the requesting user matches the actor in the message, which allows remote authenticated users to impersonate arbitrary users via the actor field in a message. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/128485/Moab-Insecure-Message-Signing-Authentication-Bypass.html - http://www.securityfocus.com/bid/70171 - http://www.adaptivecomputing.com/security-advisory
Authentication-Bypass.html - http://www.securityfocus.com/bid/70171 - http://www.adaptivecomputing.com/security-advisory/ - http://www.securityfocus.com/archive/1/533577/100/0/threaded - https://exchange.xforce.ibmcloud.com/vulnerabilities/96700
CVE ID: CVE-2014-5377 State: PUBLISHED Published: 2014-09-04T17:00:00 Last Updated: 2024-08-06T11:41:49.117Z Vendors: n/a Products: n/a Problem Types: n/a Description: ReadUsersFromMasterServlet in ManageEngine DeviceExpert before 5.9 build 5981 allows remote attackers to obtain user account credentials via a direct request. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/34449 - http://www.manageengine.com/products/device-expert/release-notes.html - http://packetstormsecurity.com/files/128019/ManageEngine-DeviceExpert-5.9-Credential-Disclosure.html - https://raw.githubusercontent.com/pedrib/PoC/master/me_deviceexpert-5.txt - http://seclist
-Credential-Disclosure.html - https://raw.githubusercontent.com/pedrib/PoC/master/me_deviceexpert-5.txt - http://seclists.org/fulldisclosure/2014/Aug/75 - http://www.securityfocus.com/bid/69443 - http://www.securityfocus.com/archive/1/533250/100/0/threaded - http://seclists.org/fulldisclosure/2014/Aug/84 - https://exchange.xforce.ibmcloud.com/vulnerabilities/95562 - http://seclists.org/fulldisclosure/2014/Aug/76
CVE ID: CVE-2014-5380 State: PUBLISHED Published: 2020-01-13T12:55:56 Last Updated: 2024-08-06T11:41:48.972Z Vendors: n/a Products: n/a Problem Types: n/a Description: Grand MA 300 allows retrieval of the access PIN from sniffed data. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/128003/Grand-MA-300-Fingerprint-Reader-Weak-PIN-Verification.html - http://www.securityfocus.com/bid/69390 - http://seclists.org/fulldisclosure/2014/Aug/70 - https://exchange.xforce.ibmcloud.com/vulnerabilities/95484
CVE ID: CVE-2014-5381 State: PUBLISHED Published: 2020-01-13T13:00:00 Last Updated: 2024-08-06T11:41:49.064Z Vendors: n/a Products: n/a Problem Types: n/a Description: Grand MA 300 allows a brute-force attack on the PIN. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/128003/Grand-MA-300-Fingerprint-Reader-Weak-PIN-Verification.html - http://www.securityfocus.com/bid/69390 - http://seclists.org/fulldisclosure/2014/Aug/70 - https://exchange.xforce.ibmcloud.com/vulnerabilities/95485
CVE ID: CVE-2014-5382 State: PUBLISHED Published: 2014-08-20T14:00:00Z Last Updated: 2024-09-16T20:16:52.139Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the web interface in Schrack Technik microControl with firmware 1.7.0 (937) allow remote attackers to inject arbitrary web script or HTML via the position textbox in the configuration menu or other unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2014/Jul/40 - https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140710-2_Schrack_Technik_Microcontrol_Multiple_critical_vulnerabilitie
.com/fxdata/seccons/prod/temedia/advisories_txt/20140710-2_Schrack_Technik_Microcontrol_Multiple_critical_vulnerabilities_v10.txt
CVE ID: CVE-2014-5383 State: PUBLISHED Published: 2014-08-21T14:00:00 Last Updated: 2024-08-06T11:41:49.070Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in AlienVault OSSIM before 4.7.0 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://forums.alienvault.com/discussion/2690 - http://www.securityfocus.com/bid/67312
CVE ID: CVE-2014-5384 State: PUBLISHED Published: 2014-08-21T22:00:00 Last Updated: 2024-08-06T11:41:49.148Z Vendors: n/a Products: n/a Problem Types: n/a Description: The VIQR module in the iconv implementation in FreeBSD 10.0 before p6 and NetBSD allows context-dependent attackers to cause a denial of service (out-of-bounds array access) via a crafted argument to the iconv_open function. NOTE: this issue was SPLIT from CVE-2014-3951 per ADT2 due to different vulnerability types. Additional Analyst Notes: - CVE Program Container: References: - http://www.freebsd.org/security/advisories/FreeBSD-SA-14:15.iconv.asc - http://www.securitytracker.com/id/1030458 - http://mail-index.netbsd.org/sour
ty/advisories/FreeBSD-SA-14:15.iconv.asc - http://www.securitytracker.com/id/1030458 - http://mail-index.netbsd.org/source-changes/2014/06/24/msg055822.html
CVE ID: CVE-2014-5385 State: PUBLISHED Published: 2014-08-21T23:00:00 Last Updated: 2024-08-06T11:41:49.222Z Vendors: n/a Products: n/a Problem Types: n/a Description: com/salesmanager/central/profile/ProfileAction.java in Shopizer 1.1.5 and earlier does not restrict the number of authentication attempts, which makes it easier for remote attackers to guess passwords via a brute force attack. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/532726/100/0/threaded - http://seclists.org/fulldisclosure/2014/Jul/38
CVE ID: CVE-2014-5386 State: PUBLISHED Published: 2014-12-28T15:00:00 Last Updated: 2024-08-06T11:41:49.092Z Vendors: n/a Products: n/a Problem Types: n/a Description: The mcrypt_create_iv function in hphp/runtime/ext/mcrypt/ext_mcrypt.cpp in Facebook HipHop Virtual Machine (HHVM) before 3.3.0 does not seed the random number generator, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging the use of a single initialization vector. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/facebook/hhvm/commit/ab6fdeb84fb090b48606b6f7933028cfe7bf3a5e
CVE ID: CVE-2014-5387 State: PUBLISHED Published: 2014-11-04T15:00:00 Last Updated: 2024-08-06T11:41:48.749Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in EllisLab ExpressionEngine before 2.9.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) column_filter or (2) category[] parameter to system/index.php or the (3) tbl_sort[0][] parameter in the comment module to system/index.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/128946/EllisLab-ExpressionEngine-Core-SQL-Injection.html - https://ellislab.com/expressionengine/user-guide/about/changelog.html -
isLab-ExpressionEngine-Core-SQL-Injection.html - https://ellislab.com/expressionengine/user-guide/about/changelog.html - http://www.securityfocus.com/bid/70875 - http://seclists.org/fulldisclosure/2014/Nov/2 - https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-5387
CVE ID: CVE-2014-5388 State: PUBLISHED Published: 2014-11-15T21:00:00 Last Updated: 2024-08-06T11:41:49.221Z Vendors: n/a Products: n/a Problem Types: n/a Description: Off-by-one error in the pci_read function in the ACPI PCI hotplug interface (hw/acpi/pcihp.c) in QEMU allows local guest users to obtain sensitive information and have other unspecified impact related to a crafted PCI device that triggers memory corruption. Additional Analyst Notes: - CVE Program Container: References: - https://lists.gnu.org/archive/html/qemu-devel/2014-08/msg03338.html - http://seclists.org/oss-sec/2014/q3/438 - http://seclists.org/oss-sec/2014/q3/440 - https://bugzilla.redhat.com/show_bug.cgi?id=1132956 - h
/oss-sec/2014/q3/438 - http://seclists.org/oss-sec/2014/q3/440 - https://bugzilla.redhat.com/show_bug.cgi?id=1132956 - http://www.ubuntu.com/usn/USN-2409-1 - http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=fa365d7cd11185237471823a5a33d36765454e16
CVE ID: CVE-2014-5389 State: PUBLISHED Published: 2014-10-06T14:00:00 Last Updated: 2024-08-06T11:41:49.219Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in content-audit-schedule.php in the Content Audit plugin before 1.6.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the "Audited content types" option in the content-audit page to wp-admin/options-general.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/128525/WordPress-Content-Audit-1.6-Blind-SQL-Injection.html - http://www.securityfocus.com/bid/70214 - https://security.dxw.com/advisories/blind-sqli-vulnerabili
SQL-Injection.html - http://www.securityfocus.com/bid/70214 - https://security.dxw.com/advisories/blind-sqli-vulnerability-in-content-audit-could-allow-a-privileged-attacker-to-exfiltrate-password-hashes/ - http://seclists.org/fulldisclosure/2014/Oct/8 - https://wordpress.org/plugins/content-audit/changelog
CVE ID: CVE-2014-5391 State: PUBLISHED Published: 2014-09-11T15:00:00 Last Updated: 2024-08-06T11:41:49.066Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the JobScheduler Operations Center (JOC) in SOS JobScheduler before 1.6.4246 and 1.7.x before 1.7.4241 allows remote attackers to inject arbitrary web script or HTML via the hash property (location.hash). Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/69660 - http://packetstormsecurity.com/files/128180/JobScheduler-Cross-Site-Scripting.html - http://www.sos-berlin.com/modules/news/article.php?storyid=73 - http://www.sos-berlin.com/mo
Cross-Site-Scripting.html - http://www.sos-berlin.com/modules/news/article.php?storyid=73 - http://www.sos-berlin.com/modules/news/article.php?storyid=74 - http://www.securityfocus.com/archive/1/533372/100/0/threaded - https://change.sos-berlin.com/browse/JS-1203 - https://exchange.xforce.ibmcloud.com/vulnerabilities/95797 - http://www.christian-schneider.net/advisories/CVE-2014-5391.txt
CVE ID: CVE-2014-5392 State: PUBLISHED Published: 2014-09-23T15:00:00 Last Updated: 2024-08-06T11:41:49.209Z Vendors: n/a Products: n/a Problem Types: n/a Description: XML External Entity (XXE) vulnerability in JobScheduler before 1.6.4246 and 7.x before 1.7.4241 allows remote attackers to cause a denial of service and read arbitrary files or directories via a request containing an XML external entity declaration in conjunction with an entity reference. Additional Analyst Notes: - CVE Program Container: References: - http://www.sos-berlin.com/modules/news/article.php?storyid=73 - http://www.christian-schneider.net/advisories/CVE-2014-5392.txt - https://change.sos-berlin.com/browse/JS-1204 -
d=73 - http://www.christian-schneider.net/advisories/CVE-2014-5392.txt - https://change.sos-berlin.com/browse/JS-1204 - http://packetstormsecurity.com/files/128181/JobScheduler-XML-eXternal-Entity-Injection.html - http://www.securityfocus.com/archive/1/533374/100/0/threaded
CVE ID: CVE-2014-5393 State: PUBLISHED Published: 2014-09-11T15:00:00 Last Updated: 2024-08-06T11:41:49.222Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the JobScheduler Operations Center (JOC) in SOS JobScheduler before 1.6.4246 and 1.7.x before 1.7.4241 allows remote authenticated users with the info permission to read arbitrary files in the webroot via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.christian-schneider.net/advisories/CVE-2014-5393.txt - http://www.sos-berlin.com/modules/news/article.php?storyid=73 - http://www.sos-berlin.com/modules/news/article.php?storyid=74 - http://pac
lin.com/modules/news/article.php?storyid=73 - http://www.sos-berlin.com/modules/news/article.php?storyid=74 - http://packetstormsecurity.com/files/128192/JobScheduler-Path-Traversal.html - https://change.sos-berlin.com/browse/JS-1205 - http://www.securityfocus.com/archive/1/533373/100/0/threaded - https://exchange.xforce.ibmcloud.com/vulnerabilities/95796
CVE ID: CVE-2014-5394 State: PUBLISHED Published: 2018-01-08T19:00:00 Last Updated: 2024-08-06T11:41:49.182Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple Huawei Campus switches allow remote attackers to enumerate usernames via vectors involving use of SSH by the maintenance terminal. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/69302 - http://www.huawei.com/us/psirt/security-advisories/2014/hw-362701 - https://exchange.xforce.ibmcloud.com/vulnerabilities/97763
CVE ID: CVE-2014-5395 State: PUBLISHED Published: 2014-11-21T15:00:00 Last Updated: 2024-08-06T11:41:49.232Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Huawei HiLink E3276 and E3236 TCPU before V200R002B470D13SP00C00 and WebUI before V100R007B100D03SP01C03, E5180s-22 before 21.270.21.00.00, and E586Bs-2 before 21.322.10.00.889 allow remote attackers to hijack the authentication of users for requests that (1) modify configurations, (2) send SMS messages, or have other unspecified impact via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.huawei.com/en/security/psirt/secur
vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-360246.htm - http://www.securityfocus.com/bid/69162 - https://www.exploit-db.com/exploits/46092/
CVE ID: CVE-2014-5396 State: PUBLISHED Published: 2014-08-22T14:00:00Z Last Updated: 2024-09-16T19:56:09.399Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web interface in Schrack Technik microControl with firmware before 1.7.0 (937) has a hardcoded password of not for the "user" account, which makes it easier for remote attackers to obtain access via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2014/Jul/40 - https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140710-2_Schrack_Technik_Microcontrol_Multiple_critical_vulnerabilities_v10.txt
CVE ID: CVE-2014-5397 State: PUBLISHED Published: 2014-08-28T01:00:00 Last Updated: 2025-10-31T23:14:04.849Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Schneider Electric Products: Wonderware Information Server Portal Problem Types: CWE-79 Description: Cross-site scripting (XSS) vulnerability in Schneider Electric Wonderware Information Server (WIS) Portal 4.0 SP1 through 5.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-14-238-02 - https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2014/icsa-14-238-02.
ts/ics-advisories/icsa-14-238-02 - https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2014/icsa-14-238-02.json
CVE ID: CVE-2014-5398 State: PUBLISHED Published: 2014-08-28T01:00:00 Last Updated: 2025-10-31T23:16:04.348Z Severity: N/A (CVSS 2.1 AV:L/AC:L/Au:N/C:P/I:N/A:N) Vendors: Schneider Electric Products: Wonderware Information Server Portal Problem Types: CWE-20 Description: Schneider Electric Wonderware Information Server (WIS) Portal 4.0 SP1 through 5.5 allows remote attackers to read arbitrary files or cause a denial of service via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-14-238-02 - https://githu
s: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-14-238-02 - https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2014/icsa-14-238-02.json