Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2014-4834 State: PUBLISHED Published: 2014-11-05T11:00:00 Last Updated: 2024-08-06T11:27:36.924Z Vendors: n/a Products: n/a Problem Types: n/a Description: IBM WebSphere Commerce 6.x through 6.0.0.11 and 7.x through 7.0.0.8 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption, and application crash) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg1JR50553 - http://www-01.ibm.com/support/docview.wss?uid=swg1JR
nces: - http://www-01.ibm.com/support/docview.wss?uid=swg1JR50553 - http://www-01.ibm.com/support/docview.wss?uid=swg1JR49897 - https://exchange.xforce.ibmcloud.com/vulnerabilities/95628 - http://www-01.ibm.com/support/docview.wss?uid=swg21685464 - http://www.securityfocus.com/bid/70870
CVE ID: CVE-2014-4835 State: PUBLISHED Published: 2015-01-17T11:00:00 Last Updated: 2024-08-06T11:27:36.879Z Vendors: n/a Products: n/a Problem Types: n/a Description: IBM ServerGuide before 9.63, UpdateXpress System Packs Installer (UXSPI) before 9.63, and ToolsCenter Suite before 9.63 place credentials in logs, which allows local users to obtain sensitive information by reading a file. Additional Analyst Notes: - CVE Program Container: References: - http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5096777 - https://exchange.xforce.ibmcloud.com/vulnerabilities/95629
CVE ID: CVE-2014-4836 State: PUBLISHED Published: 2014-10-19T01:00:00 Last Updated: 2024-08-06T11:27:36.883Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in breakOutWithName.jsp in IBM TRIRIGA Application Platform 3.2 and 3.3 before 3.3.0.2, 3.3.1 before 3.3.1.3, 3.3.2 before 3.3.2.2, and 3.4 before 3.4.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg21686240 - http://secunia.com/advisories/61056 - https://exchange.xforce.ibmcloud.com/vulnerabilities/95630
CVE ID: CVE-2014-4837 State: PUBLISHED Published: 2014-10-19T01:00:00 Last Updated: 2024-08-06T11:27:36.927Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in NewDocument.jsp in IBM TRIRIGA Application Platform 3.2 and 3.3 before 3.3.0.2, 3.3.1 before 3.3.1.3, 3.3.2 before 3.3.2.2, and 3.4 before 3.4.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/61056 - https://exchange.xforce.ibmcloud.com/vulnerabilities/95631 - http://www-01.ibm.com/support/docview.wss?uid=swg21686238
CVE ID: CVE-2014-4838 State: PUBLISHED Published: 2014-10-19T01:00:00 Last Updated: 2024-08-06T11:27:36.905Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in GanttProjectSchedulerPopup.jsp in IBM TRIRIGA Application Platform 3.2 and 3.3 before 3.3.0.2, 3.3.1 before 3.3.1.3, 3.3.2 before 3.3.2.2, and 3.4 before 3.4.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/61056 - https://exchange.xforce.ibmcloud.com/vulnerabilities/95634 - http://www-01.ibm.com/support/docview.wss?uid=swg21686233
CVE ID: CVE-2014-4839 State: PUBLISHED Published: 2014-10-29T10:00:00 Last Updated: 2024-08-06T11:27:36.907Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in birtviewer.query in IBM TRIRIGA Application Platform 3.2 and 3.3 before 3.3.0.2, 3.3.1 before 3.3.1.3, 3.3.2 before 3.3.2.2, and 3.4 before 3.4.0.1 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/95635 - http://www-01.ibm.com/support/docview.wss?uid=swg21686241
CVE ID: CVE-2014-4840 State: PUBLISHED Published: 2014-10-19T01:00:00 Last Updated: 2024-08-06T11:27:36.882Z Vendors: n/a Products: n/a Problem Types: n/a Description: IBM TRIRIGA Application Platform 3.2 and 3.3 before 3.3.0.2, 3.3.1 before 3.3.1.3, 3.3.2 before 3.3.2.2, and 3.4 before 3.4.0.1 allows remote attackers to execute arbitrary code via a crafted URL. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/61056 - http://www-01.ibm.com/support/docview.wss?uid=swg21686230 - https://exchange.xforce.ibmcloud.com/vulnerabilities/95636
CVE ID: CVE-2014-4843 State: PUBLISHED Published: 2017-06-08T16:00:00 Last Updated: 2024-08-06T11:27:36.894Z Vendors: n/a Products: n/a Problem Types: n/a Description: Curam Universal Access in IBM Curam Social Program Management (SPM) 6.0 SP2 before EP26, 6.0.4 before 6.0.4.6, and 6.0.5 before 6.0.5.5 iFix5 allows remote attackers to obtain sensitive information about internal caseworker usernames via vectors related to a URL. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/73943 - http://www-01.ibm.com/support/docview.wss?uid=swg21698548
CVE ID: CVE-2014-4844 State: PUBLISHED Published: 2014-12-17T00:00:00 Last Updated: 2024-08-06T11:27:36.840Z Vendors: n/a Products: n/a Problem Types: n/a Description: The import/export functionality in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.5 allows remote authenticated users to bypass intended access restrictions via a project action for a (1) process application or (2) toolkit. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/95724 - http://www.ibm.com/support/docview.wss?uid=swg21690554 - http://www-01.ibm.com/support/docview.wss?uid=swg1JR51286
CVE ID: CVE-2014-4845 State: PUBLISHED Published: 2014-07-10T14:00:00 Last Updated: 2024-08-06T11:27:36.901Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the BannerMan plugin 0.2.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the bannerman_background parameter to wp-admin/options-general.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/68278 - http://packetstormsecurity.com/files/127289/WordPress-Bannerman-0.2.4-Cross-Site-Scripting.html
CVE ID: CVE-2014-4846 State: PUBLISHED Published: 2014-07-10T14:00:00 Last Updated: 2024-08-06T11:27:36.852Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Meta Slider (ml-slider) plugin 2.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter to wp-admin/admin.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/68283 - http://packetstormsecurity.com/files/127288/WordPress-ml-slider-2.5-Cross-Site-Scripting.html
CVE ID: CVE-2014-4847 State: PUBLISHED Published: 2014-07-10T16:00:00 Last Updated: 2024-08-06T11:27:36.901Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Random Banner plugin 1.1.2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the buffercode_RBanner_url_banner1 parameter in an update action to wp-admin/options.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/127292/WordPress-Random-Banner-1.1.2.1-Cross-Site-Scripting.html - http://www.securityfocus.com/bid/68280
CVE ID: CVE-2014-4848 State: PUBLISHED Published: 2014-07-10T16:00:00 Last Updated: 2024-08-06T11:27:37.024Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Blogstand Banner (blogstand-smart-banner) plugin 1.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the bs_blog_id parameter to wp-admin/options-general.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/127290/WordPress-Blogstand-Smart-Banner-1.0-Cross-Site-Scripting.html - http://www.securityfocus.com/bid/68282
CVE ID: CVE-2014-4849 State: PUBLISHED Published: 2014-07-10T16:00:00Z Last Updated: 2024-09-16T17:18:42.591Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in msg.php in FoeCMS allow remote attackers to inject arbitrary web script or HTML via the (1) e or (2) r parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/127358/FoeCMS-XSS-SQL-Injection-Open-Redirect.html
CVE ID: CVE-2014-4850 State: PUBLISHED Published: 2014-07-10T16:00:00Z Last Updated: 2024-09-17T03:23:27.954Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in index.php in FoeCMS allows remote attackers to execute arbitrary SQL commands via the i parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/127358/FoeCMS-XSS-SQL-Injection-Open-Redirect.html
CVE ID: CVE-2014-4851 State: PUBLISHED Published: 2014-07-10T16:00:00Z Last Updated: 2024-09-16T17:47:52.495Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open redirect vulnerability in msg.php in FoeCMS allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the r parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/127358/FoeCMS-XSS-SQL-Injection-Open-Redirect.html
CVE ID: CVE-2014-4852 State: PUBLISHED Published: 2014-07-10T16:00:00Z Last Updated: 2024-09-16T18:08:35.605Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in admin/uploads.php in The Digital Craft AtomCMS, possibly 2.0, allows remote attackers to execute arbitrary SQL commands via the id parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/127371/Atom-CMS-Shell-Upload-SQL-Injection.html - http://www.securityfocus.com/bid/68437
CVE ID: CVE-2014-4853 State: PUBLISHED Published: 2014-07-10T16:00:00Z Last Updated: 2024-09-16T21:04:21.539Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in odm-init.php in OpenDocMan before 1.2.7.3 allows remote authenticated users to inject arbitrary web script or HTML via the file name of an uploaded file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/opendocman/opendocman/issues/163 - https://github.com/opendocman/opendocman/commit/d202ef3def8674be61a3e4ccbe28beba4953b7ce - http://www.opendocman.com/opendocman-v1-2-7-3-release-notes - http://packetstormsecurity.com/files/127330/OpenDocMan-1.2.7.
p://www.opendocman.com/opendocman-v1-2-7-3-release-notes - http://packetstormsecurity.com/files/127330/OpenDocMan-1.2.7.2-Cross-Site-Scripting.html
CVE ID: CVE-2014-4854 State: PUBLISHED Published: 2014-07-10T16:00:00 Last Updated: 2024-08-06T11:27:36.861Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the WP Construction Mode plugin 1.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via the wuc_logo parameter in a save action to wp-admin/admin.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/68287 - http://packetstormsecurity.com/files/127287/WordPress-Construction-Mode-1.8-Cross-Site-Scripting.html
CVE ID: CVE-2014-4855 State: PUBLISHED Published: 2014-07-10T16:00:00Z Last Updated: 2024-09-16T18:03:00.794Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Polylang plugin before 1.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via vectors related to a user description. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://wordpress.org/plugins/polylang/changelog - http://secunia.com/advisories/59357
CVE ID: CVE-2014-4856 State: PUBLISHED Published: 2014-07-10T16:00:00Z Last Updated: 2024-09-17T04:20:28.207Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Polldaddy Polls & Ratings plugin before 2.0.25 for WordPress allows remote attackers to inject arbitrary web script or HTML via vectors related to a ratings shortcode and a unique ID. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/59323 - http://wordpress.org/plugins/polldaddy/changelog
CVE ID: CVE-2014-4857 State: PUBLISHED Published: 2014-07-26T15:00:00 Last Updated: 2024-08-06T11:27:36.808Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Gurock TestRail before 3.1.3 allows remote attackers to inject arbitrary web script or HTML via the Created By field in a project activity. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/669804 - http://forum.gurock.com/topic/1652/testrail-313-released/
CVE ID: CVE-2014-4858 State: PUBLISHED Published: 2014-07-26T10:00:00 Last Updated: 2024-08-06T11:27:36.878Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in CWPLogin.aspx in Sabre AirCentre Crew products 2010.2.12.20008 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password field. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/68899 - http://www.kb.cert.org/vuls/id/394540
CVE ID: CVE-2014-4859 State: PUBLISHED Published: 2020-01-31T15:08:20 Last Updated: 2024-08-06T11:27:36.851Z Vendors: Phoenix Technologies Ltd., American Megatrends Incorporated (AMI) Products: SCT3, BIOS Problem Types: Integer Overflow Description: Integer overflow in the Drive Execution Environment (DXE) phase in the Capsule Update feature in the UEFI implementation in EDK2 allows physically proximate attackers to bypass intended access restrictions via crafted data. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/552286
CVE ID: CVE-2014-4860 State: PUBLISHED Published: 2020-01-31T15:08:16 Last Updated: 2024-08-06T11:27:36.943Z Vendors: Phoenix Technologies Ltd., American Megatrends Incorporated (AMI) Products: SCT3, BIOS Problem Types: Other Description: Multiple integer overflows in the Pre-EFI Initialization (PEI) boot phase in the Capsule Update feature in the UEFI implementation in EDK2 allow physically proximate attackers to bypass intended access restrictions by providing crafted data that is not properly handled during the coalescing phase. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/552286
CVE ID: CVE-2014-4861 State: PUBLISHED Published: 2018-03-09T20:00:00 Last Updated: 2024-08-06T11:27:36.904Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Remote Desktop Launcher in Thycotic Secret Server before 8.6.000010 does not properly cleanup a temporary file that contains an encrypted password once a session has ended. Additional Analyst Notes: - CVE Program Container: References: - http://thycotic.com/products/secret-server/resources/advisories/cve-2014-4861/
CVE ID: CVE-2014-4862 State: PUBLISHED Published: 2014-09-05T17:00:00 Last Updated: 2024-08-06T11:27:36.926Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Netmaster CBW700N cable modem with software 81.447.392110.729.024 has an SNMP community of public, which allows remote attackers to obtain sensitive credential, key, and SSID information via an SNMP request. Additional Analyst Notes: - CVE Program Container: References: - https://community.rapid7.com/community/metasploit/blog/2014/08/21/more-snmp-information-leaks-cve-2014-4862-and-cve-2014-4863 - http://www.kb.cert.org/vuls/id/259548
CVE ID: CVE-2014-4863 State: PUBLISHED Published: 2014-09-05T17:00:00 Last Updated: 2024-08-06T11:27:36.909Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Arris Touchstone DG950A cable modem with software 7.10.131 has an SNMP community of public, which allows remote attackers to obtain sensitive password, key, and SSID information via an SNMP request. Additional Analyst Notes: - CVE Program Container: References: - https://community.rapid7.com/community/metasploit/blog/2014/08/21/more-snmp-information-leaks-cve-2014-4862-and-cve-2014-4863 - http://www.kb.cert.org/vuls/id/855836
CVE ID: CVE-2014-4864 State: PUBLISHED Published: 2014-09-10T10:00:00 Last Updated: 2024-08-06T11:27:36.906Z Vendors: n/a Products: n/a Problem Types: n/a Description: The NETGEAR ProSafe Plus Configuration Utility creates configuration backup files containing cleartext passwords, which might allow remote attackers to obtain sensitive information by reading a file. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/396212
CVE ID: CVE-2014-4865 State: PUBLISHED Published: 2014-09-10T18:00:00 Last Updated: 2024-08-06T11:27:36.967Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in gui/password-wadmin.apl in CacheGuard OS 5.7.7 allows remote attackers to hijack the authentication of arbitrary users. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2014/Sep/38 - http://www.kb.cert.org/vuls/id/241508
CVE ID: CVE-2014-4867 State: PUBLISHED Published: 2014-10-10T10:00:00 Last Updated: 2024-08-06T11:27:36.889Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cryoserver Security Appliance 7.3.x uses weak permissions for /etc/init.d/cryoserver, which allows local users to gain privileges by leveraging access to the support account and running the /bin/cryo-mgmt program. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/280844
CVE ID: CVE-2014-4868 State: PUBLISHED Published: 2014-10-07T10:00:00 Last Updated: 2024-08-06T11:27:36.919Z Vendors: n/a Products: n/a Problem Types: n/a Description: The management console on the Brocade Vyatta 5400 vRouter 6.4R(x), 6.6R(x), and 6.7R1 allows remote authenticated users to execute arbitrary Linux commands via shell metacharacters in a console command. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/111588
CVE ID: CVE-2014-4869 State: PUBLISHED Published: 2014-10-07T10:00:00 Last Updated: 2024-08-06T11:27:36.875Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Brocade Vyatta 5400 vRouter 6.4R(x), 6.6R(x), and 6.7R1 allows attackers to obtain sensitive encrypted-password information by leveraging membership in the operator group. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/111588
CVE ID: CVE-2014-4870 State: PUBLISHED Published: 2014-10-07T10:00:00 Last Updated: 2024-08-06T11:27:36.877Z Vendors: n/a Products: n/a Problem Types: n/a Description: /opt/vyatta/bin/sudo-users/vyatta-clear-dhcp-lease.pl on the Brocade Vyatta 5400 vRouter 6.4R(x), 6.6R(x), and 6.7R1 does not properly validate parameters, which allows local users to gain privileges by leveraging the sudo configuration. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/111588
CVE ID: CVE-2014-4871 State: PUBLISHED Published: 2014-10-07T10:00:00 Last Updated: 2024-08-06T11:27:36.913Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in wlsecurity.html on NetCommWireless NB604N routers with firmware before GAN5.CZ56T-B-NC.AU-R4B030.EN allows remote attackers to inject arbitrary web script or HTML via the wlWpaPsk parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/70253 - http://www.kb.cert.org/vuls/id/941108
CVE ID: CVE-2014-4872 State: PUBLISHED Published: 2014-10-10T10:00:00 Last Updated: 2024-08-06T11:27:37.027Z Vendors: n/a Products: n/a Problem Types: n/a Description: BMC Track-It! 11.3.0.355 does not require authentication on TCP port 9010, which allows remote attackers to upload arbitrary files, execute arbitrary code, or obtain sensitive credential and configuration information via a .NET Remoting request to (1) FileStorageService or (2) ConfigurationService. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/128594/BMC-Track-it-Remote-Code-Execution-SQL-Injection.html - http://www.kb.cert.org/vuls/id/121036 - https://raw.githubuserconte
-Track-it-Remote-Code-Execution-SQL-Injection.html - http://www.kb.cert.org/vuls/id/121036 - https://raw.githubusercontent.com/pedrib/PoC/master/generic/bmc-track-it-11.3.txt
CVE ID: CVE-2014-4873 State: PUBLISHED Published: 2014-10-10T10:00:00 Last Updated: 2024-08-06T11:27:36.900Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in TrackItWeb/Grid/GetData in BMC Track-It! 11.3.0.355 allows remote authenticated users to execute arbitrary SQL commands via crafted POST data. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/128594/BMC-Track-it-Remote-Code-Execution-SQL-Injection.html - http://www.kb.cert.org/vuls/id/121036 - http://www.securityfocus.com/bid/70268 - https://raw.githubusercontent.com/pedrib/PoC/master/generic/bmc-track-it-11.3.txt
CVE ID: CVE-2014-4874 State: PUBLISHED Published: 2014-10-10T10:00:00 Last Updated: 2024-08-06T11:27:36.984Z Vendors: n/a Products: n/a Problem Types: n/a Description: BMC Track-It! 11.3.0.355 allows remote authenticated users to read arbitrary files by visiting the TrackItWeb/Attachment page. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/128594/BMC-Track-it-Remote-Code-Execution-SQL-Injection.html - http://www.kb.cert.org/vuls/id/121036 - https://raw.githubusercontent.com/pedrib/PoC/master/generic/bmc-track-it-11.3.txt
CVE ID: CVE-2014-4875 State: PUBLISHED Published: 2015-06-24T10:00:00 Last Updated: 2024-08-06T11:27:36.993Z Vendors: n/a Products: n/a Problem Types: n/a Description: CreateBossCredentials.jar in Toshiba CHEC before 6.6 build 4014 and 6.7 before build 4329 contains a hardcoded AES key, which allows attackers to discover Back Office System Server (BOSS) DB2 database credentials by leveraging knowledge of this key in conjunction with bossinfo.pro read access. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/301788 - http://www.kb.cert.org/vuls/id/JLAD-9X4SPN
CVE ID: CVE-2014-4876 State: PUBLISHED Published: 2015-12-31T02:00:00 Last Updated: 2024-08-06T11:27:36.878Z Vendors: n/a Products: n/a Problem Types: n/a Description: Toshiba 4690 Operating System 6 Release 3, when the ADXSITCF logical name is not properly restricted, allows remote attackers to read potentially sensitive system environment variables via a crafted request to TCP port 54138. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/924506 - https://www.kb.cert.org/vuls/id/JLAD-9X4TDL