Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2014-4710 State: PUBLISHED Published: 2014-07-29T14:00:00 Last Updated: 2024-08-06T11:27:36.220Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in zero_user_account.php in ZeroCMS 1.0 allows remote attackers to inject arbitrary web script or HTML via the Full Name field. Additional Analyst Notes: - CVE Program Container: References: - https://community.qualys.com/blogs/securitylabs/2014/07/24/yet-another-zerocms-cross-site-scripting-vulnerability-cve-2014-4710 - http://packetstormsecurity.com/files/127634/ZeroCMS-1.0-Cross-Site-Scripting.html - http://www.exploit-db.com/exploits/34170
CVE ID: CVE-2014-4714 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2021-01-06T16:15:58 Description: No description available.
CVE ID: CVE-2014-4715 State: PUBLISHED Published: 2014-07-03T01:00:00 Last Updated: 2024-08-06T11:27:36.198Z Vendors: n/a Products: n/a Problem Types: n/a Description: Yann Collet LZ4 before r119, when used on certain 32-bit platforms that allocate memory beyond 0x80000000, does not properly detect integer overflows, which allows context-dependent attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted Literal Run, a different vulnerability than CVE-2014-4611. Additional Analyst Notes: - CVE Program Container: References: - https://code.google.com/p/lz4/source/detail?r=119 - http://secunia.com/advisories/59770 - http://blog.securitym
ences: - https://code.google.com/p/lz4/source/detail?r=119 - http://secunia.com/advisories/59770 - http://blog.securitymouse.com/2014/07/i-was-wrong-proving-lz4-exploitable.html - http://fastcompression.blogspot.fr/2014/07/software-vulnerabilities-how-it-works.html - https://code.google.com/p/lz4/issues/detail?id=134
CVE ID: CVE-2014-4716 State: PUBLISHED Published: 2014-07-03T14:00:00Z Last Updated: 2024-09-16T23:41:05.858Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in Thomson TWG87OUIR allows remote attackers to hijack the authentication of unspecified victims for requests that change passwords via the Password and PasswordReEnter parameters to goform/RgSecurity. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/show/osvdb/108397 - http://www.exploit-db.com/exploits/33866 - http://packetstormsecurity.com/files/127244/Thomson-TWG87OUIR-Cross-Site-Request-Forgery.html
CVE ID: CVE-2014-4717 State: PUBLISHED Published: 2014-07-03T14:00:00Z Last Updated: 2024-09-16T22:30:44.980Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Simple Share Buttons Adder plugin before 4.5 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) ssba_share_text parameter in a save action to wp-admin/options-general.php, which is not properly handled in the homepage, and unspecified vectors related to (2) Pages, (3) Posts, (4) Category/Archive pages or (5) post Excerpts. Additional Analyst Notes: - CVE Pr
ors related to (2) Pages, (3) Posts, (4) Category/Archive pages or (5) post Excerpts. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/127238/WordPress-Simple-Share-Buttons-Adder-4.4-CSRF-XSS.html - https://security.dxw.com/advisories/csrf-and-stored-xss-in-simple-share-buttons-adder - https://wordpress.org/plugins/simple-share-buttons-adder/changelog - http://seclists.org/fulldisclosure/2014/Jun/138
CVE ID: CVE-2014-4718 State: PUBLISHED Published: 2014-07-03T14:00:00Z Last Updated: 2024-09-16T18:48:28.921Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Lunar CMS before 3.3-3 allow remote attackers to hijack the authentication of administrators for requests that (1) add Super users via a request to admin/user_create.php or conduct cross-site scripting (XSS) attacks via the (2) email or (3) subject parameter in contact_form.ext.php to admin/extensions.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/68153 - http://osvdb.org/show/osvdb/108351 - http://lunarcms.co
ontainer: References: - http://www.securityfocus.com/bid/68153 - http://osvdb.org/show/osvdb/108351 - http://lunarcms.com/Get.html - http://secunia.com/advisories/59411 - http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5188.php - http://www.exploit-db.com/exploits/33830 - http://packetstormsecurity.com/files/127188/Lunar-CMS-3.3-CSRF-Cross-Site-Scripting.html - http://osvdb.org/show/osvdb/108350
CVE ID: CVE-2014-4719 State: PUBLISHED Published: 2014-07-03T14:00:00Z Last Updated: 2024-09-16T18:33:23.009Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the login panel (svn/login/) in User-Friendly SVN (aka USVN) before 1.0.7 allows remote attackers to inject arbitrary web script or HTML via the username field. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/68155 - http://packetstormsecurity.com/files/127177/User-Friendly-SVN-Cross-Site-Scripting.html
CVE ID: CVE-2014-4720 State: PUBLISHED Published: 2014-07-06T23:00:00Z Last Updated: 2024-09-16T22:56:23.596Z Vendors: n/a Products: n/a Problem Types: n/a Description: Email::Address module before 1.904 for Perl uses an inefficient regular expression, which allows remote attackers to cause a denial of service (CPU consumption) via vectors related to "backtracking into the phrase," a different vulnerability than CVE-2014-0477. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/oss-sec/2014/q2/563 - https://github.com/rjbs/Email-Address/blob/master/Changes
CVE ID: CVE-2014-4721 State: PUBLISHED Published: 2014-07-06T23:00:00 Last Updated: 2024-08-06T11:27:36.809Z Vendors: n/a Products: n/a Problem Types: n/a Description: The phpinfo implementation in ext/standard/info.c in PHP before 5.4.30 and 5.5.x before 5.5.14 does not ensure use of the string data type for the PHP_AUTH_PW, PHP_AUTH_TYPE, PHP_AUTH_USER, and PHP_SELF variables, which might allow context-dependent attackers to obtain sensitive information from process memory by using the integer data type with crafted values, related to a "type confusion" vulnerability, as demonstrated by reading a private SSL key in an Apache HTTP Server web-hosting environment with mod_ssl and a PHP 5.3.x
demonstrated by reading a private SSL key in an Apache HTTP Server web-hosting environment with mod_ssl and a PHP 5.3.x mod_php. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg21683486 - http://secunia.com/advisories/54553 - http://rhn.redhat.com/errata/RHSA-2014-1766.html - http://www.debian.org/security/2014/dsa-2974 - https://www.sektioneins.de/en/blog/14-07-04-phpinfo-infoleak.html - http://secunia.com/advisories/59794 - http://www.php.net/ChangeLog-5.php - http://lists.opensuse.org/opensuse-updates/2014-07/msg00035.html - https://bugs.php.net/bug.php?id=67498 - http://www.oracle.com/technetwork/topics/security/bulletinja
-07/msg00035.html - https://bugs.php.net/bug.php?id=67498 - http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html - http://rhn.redhat.com/errata/RHSA-2014-1765.html - http://twitter.com/mikispag/statuses/485713462258302976 - http://secunia.com/advisories/59831 - http://lists.opensuse.org/opensuse-updates/2014-09/msg00046.html
CVE ID: CVE-2014-4722 State: PUBLISHED Published: 2014-07-07T14:00:00 Last Updated: 2024-08-06T11:27:35.333Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the OCS Reports Web Interface in OCS Inventory NG allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/532664/100/0/threaded - http://www.securityfocus.com/bid/68292 - http://packetstormsecurity.com/files/127295/OCS-Inventory-NG-Cross-Site-Scripting.html
CVE ID: CVE-2014-4723 State: PUBLISHED Published: 2014-07-07T14:00:00Z Last Updated: 2024-09-17T01:16:30.180Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Easy Banners plugin 1.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the name parameter to wp-admin/options-general.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/127293/WordPress-Easy-Banners-1.4-Cross-Site-Scripting.html
CVE ID: CVE-2014-4724 State: PUBLISHED Published: 2014-07-07T14:00:00 Last Updated: 2024-08-06T11:27:36.025Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Custom Banners plugin 1.2.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the custom_banners_registered_name parameter to wp-admin/options.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/68279 - http://packetstormsecurity.com/files/127291/WordPress-Custom-Banners-1.2.2.2-Cross-Site-Scripting.html
CVE ID: CVE-2014-4725 State: PUBLISHED Published: 2014-07-27T18:00:00 Last Updated: 2024-08-06T11:27:36.181Z Vendors: n/a Products: n/a Problem Types: n/a Description: The MailPoet Newsletters (wysija-newsletters) plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code by uploading a crafted theme using wp-admin/admin-post.php and accessing the theme in wp-content/uploads/wysija/themes/mailp/. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/wysija-newsletters/changelog/ - http://blog.sucuri.net/2014/07/remote-file-upload-vulnerability-on-mailpoet-wysija-newsletters.html - http://blog.sucu
- http://blog.sucuri.net/2014/07/remote-file-upload-vulnerability-on-mailpoet-wysija-newsletters.html - http://blog.sucuri.net/2014/07/malware-infection-breaking-wordpress-sites.html - http://arstechnica.com/security/2014/07/mass-exploit-of-wordpress-plugin-backdoors-sites-running-joomla-magento-too/ - http://www.openwall.com/lists/oss-security/2014/07/08/7 - http://blog.sucuri.net/2014/07/mailpoet-vulnerability-exploited-in-the-wild-breaking-thousands-of-wordpress-sites.html
CVE ID: CVE-2014-4726 State: PUBLISHED Published: 2014-07-27T18:00:00 Last Updated: 2024-08-06T11:27:36.705Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in the MailPoet Newsletters (wysija-newsletters) plugin before 2.6.8 for WordPress has unspecified impact and attack vectors. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/wysija-newsletters/changelog/ - http://www.openwall.com/lists/oss-security/2014/07/08/7
CVE ID: CVE-2014-4727 State: PUBLISHED Published: 2014-09-30T16:00:00 Last Updated: 2024-08-06T11:27:36.100Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the DHCP clients page in the TP-LINK N750 Wireless Dual Band Gigabit Router (TL-WDR4300) with firmware before 140916 allows remote attackers to inject arbitrary web script or HTML via the hostname in a DHCP request. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/96139 - http://www.securityfocus.com/archive/1/533501/100/0/threaded - http://www.securityfocus.com/archive/1/533499/100/0/threaded - http://seclists.org/
om/archive/1/533501/100/0/threaded - http://www.securityfocus.com/archive/1/533499/100/0/threaded - http://seclists.org/fulldisclosure/2014/Sep/80 - http://www.securityfocus.com/bid/70037 - http://packetstormsecurity.com/files/128343/TP-LINK-WDR4300-XSS-Denial-Of-Service.html
CVE ID: CVE-2014-4728 State: PUBLISHED Published: 2014-09-30T16:00:00 Last Updated: 2024-08-06T11:27:36.248Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web server in the TP-LINK N750 Wireless Dual Band Gigabit Router (TL-WDR4300) with firmware before 140916 allows remote attackers to cause a denial of service (crash) via a long header in a GET request. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/96140 - http://www.securityfocus.com/archive/1/533501/100/0/threaded - http://seclists.org/fulldisclosure/2014/Sep/80 - http://www.securityfocus.com/bid/70037 - http://www.securityfocus.com/archive/1/533499/
org/fulldisclosure/2014/Sep/80 - http://www.securityfocus.com/bid/70037 - http://www.securityfocus.com/archive/1/533499/100/0/threaded - http://packetstormsecurity.com/files/128343/TP-LINK-WDR4300-XSS-Denial-Of-Service.html
CVE ID: CVE-2014-4734 State: PUBLISHED Published: 2014-07-21T14:00:00 Last Updated: 2024-08-06T11:27:36.077Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in e107_admin/db.php in e107 2.0 alpha2 and earlier allows remote attackers to inject arbitrary web script or HTML via the type parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.htbridge.com/advisory/HTB23220 - https://github.com/e107inc/e107/commit/f80e417bb3e7ab5c1a89ea9ddd2cd060f54464e1 - http://www.securityfocus.com/bid/68674 - http://packetstormsecurity.com/files/127499/e107-2.0-alpha2-Cross-Site-Scripting.html - http://www.securityfocus.com/ar
http://packetstormsecurity.com/files/127499/e107-2.0-alpha2-Cross-Site-Scripting.html - http://www.securityfocus.com/archive/1/532801/100/0/threaded
CVE ID: CVE-2014-4735 State: PUBLISHED Published: 2014-09-12T14:00:00 Last Updated: 2024-08-06T11:27:36.077Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in MyWebSQL 3.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the table parameter to index.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/69553 - http://packetstormsecurity.com/files/128140/MyWebSQL-3.4-Cross-Site-Scripting.html - https://www.htbridge.com/advisory/HTB23221 - https://exchange.xforce.ibmcloud.com/vulnerabilities/95719 - http://www.securityfocus.com/archive/1/533337/100/0/threaded
CVE ID: CVE-2014-4736 State: PUBLISHED Published: 2014-07-24T14:00:00 Last Updated: 2024-08-06T11:27:36.218Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in E2 before 2.4 (2845) allows remote attackers to execute arbitrary SQL commands via the note-id parameter to @actions/comment-process. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/68843 - http://packetstormsecurity.com/files/127594/E2-2844-SQL-Injection.html - http://www.securityfocus.com/archive/1/532867/100/0/threaded - https://www.htbridge.com/advisory/HTB23222
CVE ID: CVE-2014-4737 State: PUBLISHED Published: 2014-10-10T14:00:00 Last Updated: 2024-08-06T11:27:36.047Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Textpattern CMS before 4.5.7 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to setup/index.php. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/96802 - http://packetstormsecurity.com/files/128519/Textpattern-4.5.5-Cross-Site-Scripting.html - http://textpattern.com/weblog/379/textpattern-cms-457-released-ten-years-on - https://www.htbridge.com/advisory/HTB23223 - http://www.security
/weblog/379/textpattern-cms-457-released-ten-years-on - https://www.htbridge.com/advisory/HTB23223 - http://www.securityfocus.com/archive/1/533596/100/0/threaded
CVE ID: CVE-2014-4738 State: PUBLISHED Published: 2014-07-11T20:00:00 Last Updated: 2024-08-06T11:27:36.295Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in FortiGuard FortiWeb 5.0.x, 5.1.x, and 5.2.x before 5.2.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to (1) user/ldap_user/check_dlg or (2) user/radius_user/check_dlg. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/59882 - https://exchange.xforce.ibmcloud.com/vulnerabilities/94649 - http://www.securitytracker.com/id/1030556 - http://www.fortiguard.com/advisory/FG-IR-14-012/ - http://w
bilities/94649 - http://www.securitytracker.com/id/1030556 - http://www.fortiguard.com/advisory/FG-IR-14-012/ - http://www.securityfocus.com/bid/68528
CVE ID: CVE-2014-4740 State: REJECTED Published: 2014-07-09T14:00:00 Last Updated: 2014-07-11T08:57:00 Description: No description available.
CVE ID: CVE-2014-4741 State: PUBLISHED Published: 2014-07-09T14:00:00Z Last Updated: 2024-09-16T20:12:21.532Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in demo/ads.php in Artifectx xClassified 1.2 allows remote attackers to execute arbitrary SQL commands via the catid parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/127370/xClassified-1.2-SQL-Injection.html - http://www.securityfocus.com/bid/68438
CVE ID: CVE-2014-4742 State: PUBLISHED Published: 2014-07-09T14:00:00Z Last Updated: 2024-09-16T20:03:12.544Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in system/class_link.php in the System module (module_system) in Kajona before 4.5 allows remote attackers to inject arbitrary web script or HTML via the systemid parameter in a mediaFolder action to index.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kajona/kajonacms/commit/8f1b18150cc2a8f27c96d9c4f94a81022fbb61e3 - http://secunia.com/advisories/59540 - http://www.kajona.de/en/Development/Changelog/Changelog-V4-5/changelog_45.html - https://w
ecunia.com/advisories/59540 - http://www.kajona.de/en/Development/Changelog/Changelog-V4-5/changelog_45.html - https://www.netsparker.com/critical-xss-vulnerability-in-kajonacms
CVE ID: CVE-2014-4743 State: PUBLISHED Published: 2014-07-09T14:00:00 Last Updated: 2024-08-06T11:27:36.866Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in (1) search_ajax.tpl and (2) search_ajax_small.tpl in templates/default/tpl/module_search/ in the Search module (module_search) in Kajona before 4.5 allow remote attackers to inject arbitrary web script or HTML via the search parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kajona/kajonacms/commit/4a07f949c171da6aa9a6e6c19421b0df16297180 - http://secunia.com/advisories/59540 - http://www.securityfocus.com/bid/68498 - http://www.
a6aa9a6e6c19421b0df16297180 - http://secunia.com/advisories/59540 - http://www.securityfocus.com/bid/68498 - http://www.kajona.de/en/Development/Changelog/Changelog-V4-5/changelog_45.html
CVE ID: CVE-2014-4744 State: PUBLISHED Published: 2014-07-09T14:00:00 Last Updated: 2024-08-06T11:27:36.495Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in osTicket before 1.9.2 allow remote attackers to inject arbitrary web script or HTML via the (1) Phone Number field to open.php or (2) Phone number field, (3) passwd1 field, (4) passwd2 field, or (5) do parameter to account.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.netsparker.com/critical-xss-vulnerabilities-in-osticket/ - http://www.securityfocus.com/bid/68500 - https://github.com/osTicket/osTicket-1.8/releases/tag/v1.9.2 - http://se
ket/ - http://www.securityfocus.com/bid/68500 - https://github.com/osTicket/osTicket-1.8/releases/tag/v1.9.2 - http://secunia.com/advisories/59539
CVE ID: CVE-2014-4746 State: PUBLISHED Published: 2014-08-12T01:00:00 Last Updated: 2024-08-06T11:27:36.300Z Vendors: n/a Products: n/a Problem Types: n/a Description: IBM WebSphere Portal 8.0.0 before 8.0.0.1 CF13 and 8.5.0 through CF01 provides different error codes for firewall-traversal requests depending on whether the intranet host exists, which allows remote attackers to map the intranet network via a series of requests. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg21680230 - http://secunia.com/advisories/60612 - http://www-01.ibm.com/support/docview.wss?uid=swg1PI21858 - https://exchange.xforce.ibmcloud.com/vulnerab
sories/60612 - http://www-01.ibm.com/support/docview.wss?uid=swg1PI21858 - https://exchange.xforce.ibmcloud.com/vulnerabilities/94348 - http://www.securitytracker.com/id/1030669
CVE ID: CVE-2014-4747 State: PUBLISHED Published: 2014-07-26T15:00:00 Last Updated: 2024-08-06T11:27:36.407Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Classic Meeting Server in IBM Sametime 8.x through 8.5.2.1 allows physically proximate attackers to discover a meeting password hash by leveraging access to an unattended workstation to read HTML source code within a victim's browser. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg21679221 - http://packetstormsecurity.com/files/127830/IBM-Sametime-Meet-Server-8.5-Password-Disclosure.html - http://linux.oracle.com/errata/ELSA-2014-0747.html
CVE ID: CVE-2014-4748 State: PUBLISHED Published: 2014-07-26T15:00:00 Last Updated: 2024-08-06T11:27:36.166Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Classic Meeting Server in IBM Sametime 8.x through 8.5.2.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg21679221 - http://packetstormsecurity.com/files/127831/IBM-Sametime-Meet-Server-8.5-Cross-Site-Scripting.html - http://secunia.com/advisories/60202 - http://linux.oracle.com/errata/ELSA-2014-0747.html - https://exchange.xforce.ib
- http://secunia.com/advisories/60202 - http://linux.oracle.com/errata/ELSA-2014-0747.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/94350
CVE ID: CVE-2014-4749 State: PUBLISHED Published: 2014-08-20T10:00:00 Last Updated: 2024-08-06T11:27:36.140Z Vendors: n/a Products: n/a Problem Types: n/a Description: IBM PowerVC 1.2.0 before FixPack3 does not properly use the known_hosts file, which allows man-in-the-middle attackers to spoof SSH servers via an arbitrary server key. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=nas8N1020224 - https://exchange.xforce.ibmcloud.com/vulnerabilities/94351
CVE ID: CVE-2014-4750 State: PUBLISHED Published: 2014-08-20T10:00:00 Last Updated: 2024-08-06T11:27:36.089Z Vendors: n/a Products: n/a Problem Types: n/a Description: IBM PowerVC Express Edition 1.2.0 before FixPack3 establishes an FTP session for transferring files to a managed IVM, which allows remote attackers to discover credentials by sniffing the network. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/94352 - http://www-01.ibm.com/support/docview.wss?uid=nas8N1020223 - http://www.securityfocus.com/bid/69299
CVE ID: CVE-2014-4751 State: PUBLISHED Published: 2014-08-12T01:00:00 Last Updated: 2024-08-06T11:27:36.514Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in IBM Security Access Manager for Mobile 8.0.0.0, 8.0.0.1, and 8.0.0.3 allows remote attackers to inject arbitrary web script or HTML via a crafted URL. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/60562 - https://exchange.xforce.ibmcloud.com/vulnerabilities/94353 - http://www-01.ibm.com/support/docview.wss?uid=swg21680440