Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2014-9000 State: PUBLISHED Published: 2014-11-20T11:00:00Z Last Updated: 2024-09-16T22:30:26.601Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mule Enterprise Management Console (MMC) does not properly restrict access to handler/securityService.rpc, which allows remote authenticated users to gain administrator privileges and execute arbitrary code via a crafted request that adds a new user. NOTE: this issue was originally reported for ESB Runtime 3.5.1, but it originates in MMC. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2014/Oct/107 - http://seclists.org/fulldisclosure/2014/Oct/98 - http://packetstormsecurity
//seclists.org/fulldisclosure/2014/Oct/107 - http://seclists.org/fulldisclosure/2014/Oct/98 - http://packetstormsecurity.com/files/128799 - http://www.mulesoft.org/documentation/display/current/Mule+Enterprise+Management+Console+Security+Update
CVE ID: CVE-2014-9001 State: PUBLISHED Published: 2014-11-20T11:00:00Z Last Updated: 2024-09-16T23:51:59.143Z Vendors: n/a Products: n/a Problem Types: n/a Description: reminders/index.php in Incredible PBX 11 2.0.6.5.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the (1) APPTMIN, (2) APPTHR, (3) APPTDA, (4) APPTMO, (5) APPTYR, or (6) APPTPHONE parameters. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2014/Oct/101
CVE ID: CVE-2014-9002 State: PUBLISHED Published: 2014-11-20T11:00:00 Last Updated: 2024-08-06T13:33:13.299Z Vendors: n/a Products: n/a Problem Types: n/a Description: Lantronix xPrintServer does not properly restrict access to ips/, which allows remote attackers to execute arbitrary commands via the c parameter in an rpc action. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2014/Nov/24 - http://packetstormsecurity.com/files/129091/Lantronix-xPrintServer-Remote-Command-Execution-CSRF.html - http://i.imgur.com/gjbZhXZ.png - https://exchange.xforce.ibmcloud.com/vulnerabilities/98644
CVE ID: CVE-2014-9003 State: PUBLISHED Published: 2014-11-20T11:00:00 Last Updated: 2024-08-06T13:33:13.348Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in Lantronix xPrintServer allows remote attackers to hijack the authentication of administrators for requests that modify configuration, as demonstrated by executing arbitrary commands using the c parameter in the rpc action. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/98645 - http://seclists.org/fulldisclosure/2014/Nov/24 - http://packetstormsecurity.com/files/129091/Lantronix-xPrintServer-Remote-Command-E
sts.org/fulldisclosure/2014/Nov/24 - http://packetstormsecurity.com/files/129091/Lantronix-xPrintServer-Remote-Command-Execution-CSRF.html
CVE ID: CVE-2014-9004 State: PUBLISHED Published: 2014-11-20T11:00:00 Last Updated: 2024-08-06T13:33:13.271Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in vldPersonals before 2.7.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter in a member_profile action to index.php. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/98742 - http://www.exploit-db.com/exploits/35193
CVE ID: CVE-2014-9005 State: PUBLISHED Published: 2014-11-20T11:00:00 Last Updated: 2024-08-06T13:33:13.517Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in vldPersonals before 2.7.1 allow remote attackers to execute arbitrary SQL commands via the (1) country, (2) gender1, or ((3) gender2 parameter in a search action to index.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/35193 - https://exchange.xforce.ibmcloud.com/vulnerabilities/98746
CVE ID: CVE-2014-9006 State: PUBLISHED Published: 2014-11-20T11:00:00 Last Updated: 2024-08-06T13:33:13.302Z Vendors: n/a Products: n/a Problem Types: n/a Description: Monstra 3.0.1 and earlier uses a cookie to track how many login attempts have been attempted, which allows remote attackers to conduct brute force login attacks by deleting the login_attempts cookie or setting it to certain values. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/98649 - http://packetstormsecurity.com/files/129082/Monstra-3.0.1-Bruteforce-Mitigation-Bypass.html
CVE ID: CVE-2014-9013 State: PUBLISHED Published: 2019-11-06T20:34:16 Last Updated: 2024-08-06T13:33:13.495Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace plugin 2.4.0 for WordPress allows remote authenticated users to create arbitrary users and gain admin privileges via a request to wpmp_pp_ajax_call with an execution target of wp_insert_user. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/36490/
CVE ID: CVE-2014-9014 State: PUBLISHED Published: 2019-11-06T20:34:10 Last Updated: 2024-08-06T13:33:13.315Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace plugin before 2.4.1 for WordPress allows remote authenticated users to download arbitrary files via a .. (dot dot) in the file parameter. Additional Analyst Notes: - CVE Program Container: References: - https://security.szurek.pl/wp-marketplace-240-arbitrary-file-download.html - https://www.exploit-db.com/exploits/36466/
CVE ID: CVE-2014-9015 State: PUBLISHED Published: 2014-11-24T15:00:00 Last Updated: 2024-08-06T13:33:13.543Z Vendors: n/a Products: n/a Problem Types: n/a Description: Drupal 6.x before 6.34 and 7.x before 7.34 allows remote attackers to hijack sessions via a crafted request, as demonstrated by a crafted request to a server that supports both HTTP and HTTPS sessions. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2014/11/20/3 - https://www.drupal.org/SA-CORE-2014-006 - http://www.openwall.com/lists/oss-security/2014/11/20/21 - http://secunia.com/advisories/59164 - http://secunia.com/advisories/59814 - http://www.debian.org/security
14/11/20/21 - http://secunia.com/advisories/59164 - http://secunia.com/advisories/59814 - http://www.debian.org/security/2014/dsa-3075
CVE ID: CVE-2014-9016 State: PUBLISHED Published: 2014-11-24T15:00:00 Last Updated: 2024-08-06T13:33:13.282Z Vendors: n/a Products: n/a Problem Types: n/a Description: The password hashing API in Drupal 7.x before 7.34 and the Secure Password Hashes (aka phpass) module 6.x-2.x before 6.x-2.1 for Drupal allows remote attackers to cause a denial of service (CPU and memory consumption) via a crafted request. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/node/2378375 - http://www.openwall.com/lists/oss-security/2014/11/20/3 - https://www.drupal.org/SA-CORE-2014-006 - http://www.openwall.com/lists/oss-security/2014/11/20/21 - http://secunia.com/advisories
w.drupal.org/SA-CORE-2014-006 - http://www.openwall.com/lists/oss-security/2014/11/20/21 - http://secunia.com/advisories/59164 - https://www.drupal.org/node/2378367 - http://www.openwall.com/lists/oss-security/2014/11/21/1 - http://secunia.com/advisories/59814 - http://www.debian.org/security/2014/dsa-3075
CVE ID: CVE-2014-9017 State: PUBLISHED Published: 2015-03-11T14:00:00 Last Updated: 2024-08-06T13:33:13.544Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in OpenKM before 6.4.19 (build 23338) allows remote authenticated users to inject arbitrary web script or HTML via the Subject field in a Task to frontend/index.jsp. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2015/Mar/51 - http://seclists.org/fulldisclosure/2015/Mar/48 - http://youtu.be/3jBQFAAq23k - http://packetstormsecurity.com/files/130723/OpenKM-Stored-Cross-Site-Scripting.html
CVE ID: CVE-2014-9018 State: PUBLISHED Published: 2014-12-03T18:00:00 Last Updated: 2024-08-06T13:33:13.416Z Vendors: n/a Products: n/a Problem Types: n/a Description: Icecast before 2.4.1 transmits the output of the on-connect script, which might allow remote attackers to obtain sensitive information, related to shared file descriptors. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2014/11/19/23 - http://www.mandriva.com/security/advisories?name=MDVSA-2014:231 - http://icecast.org/news/icecast-release-2_4_1/ - https://trac.xiph.org/ticket/2087 - http://lists.opensuse.org/opensuse-updates/2014-12/msg00038.html - http://www.securit
ttps://trac.xiph.org/ticket/2087 - http://lists.opensuse.org/opensuse-updates/2014-12/msg00038.html - http://www.securityfocus.com/bid/71312 - https://trac.xiph.org/ticket/2089 - https://exchange.xforce.ibmcloud.com/vulnerabilities/98991 - http://www.openwall.com/lists/oss-security/2014/11/20/22
CVE ID: CVE-2014-9019 State: PUBLISHED Published: 2014-11-20T17:00:00 Last Updated: 2024-08-06T13:33:13.369Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in ZTE ZXDSL 831CII allow remote attackers to hijack the authentication of administrators for requests that (1) change the admin user name or (2) conduct cross-site scripting (XSS) attacks via the sysUserName parameter in a save action to adminpasswd.cgi or (3) change the admin user password via the sysPassword parameter in a save action to adminpasswd.cgi. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/533930/10
d.cgi. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/533930/100/0/threaded - http://packetstormsecurity.com/files/129016/ZTE-831CII-Hardcoded-Credential-XSS-CSRF.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/98585 - http://www.securityfocus.com/bid/70984
CVE ID: CVE-2014-9020 State: PUBLISHED Published: 2014-11-20T17:00:00 Last Updated: 2024-08-06T13:33:13.374Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Quick Stats page (psilan.cgi) in ZTE ZXDSL 831 and 831CII allows remote attackers to inject arbitrary web script or HTML via the domainname parameter in a save action. NOTE: this issue was SPLIT from CVE-2014-9021 per ADT1 due to different affected products and codebases. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/533930/100/0/threaded - http://packetstormsecurity.com/files/129016/ZTE-831CII-Hardcoded-Credential-XSS-CSR
om/archive/1/533930/100/0/threaded - http://packetstormsecurity.com/files/129016/ZTE-831CII-Hardcoded-Credential-XSS-CSRF.html - http://www.securityfocus.com/bid/70984 - http://packetstormsecurity.com/files/129017/ZTE-ZXDSL-831-Cross-Site-Scripting.html - http://www.securityfocus.com/bid/70985 - https://exchange.xforce.ibmcloud.com/vulnerabilities/98584 - http://www.securityfocus.com/archive/1/533931/100/0/threaded
CVE ID: CVE-2014-9021 State: PUBLISHED Published: 2014-11-20T17:00:00 Last Updated: 2024-08-06T13:33:13.520Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in ZTE ZXDSL 831 allow remote attackers to inject arbitrary web script or HTML via the (1) tr69cAcsURL, (2) tr69cAcsUser, (3) tr69cAcsPwd, (4) tr69cConnReqPwd, or (5) tr69cDebugEnable parameter to the TR-069 client page (tr69cfg.cgi); the (6) timezone parameter to the Time and date page (sntpcfg.sntp); or the (7) hostname parameter in a save action to the Quick Stats page (psilan.cgi). NOTE: this issue was SPLIT from CVE-2014-9020 per ADT1 due to different affected products a
ick Stats page (psilan.cgi). NOTE: this issue was SPLIT from CVE-2014-9020 per ADT1 due to different affected products and codebases. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/98565 - http://packetstormsecurity.com/files/129017/ZTE-ZXDSL-831-Cross-Site-Scripting.html - http://www.securityfocus.com/bid/70985 - http://www.securityfocus.com/archive/1/533931/100/0/threaded
CVE ID: CVE-2014-9022 State: PUBLISHED Published: 2014-11-20T17:00:00Z Last Updated: 2024-09-16T22:46:00.484Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Webform Component Roles module 6.x-1.x before 6.x-1.8 and 7.x-1.x before 7.x-1.8 for Drupal allows remote attackers to bypass the "disabled" restriction and modify read-only components via a crafted form. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/node/2373471 - https://www.drupal.org/node/2373473 - https://www.drupal.org/node/2373973
CVE ID: CVE-2014-9023 State: PUBLISHED Published: 2014-11-20T17:00:00 Last Updated: 2024-08-06T13:33:13.428Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Twilio module 7.x-1.x before 7.x-1.9 for Drupal does not properly restrict access to the Twilio administration pages, which allows remote authenticated users to read and modify authentication tokens by leveraging the "access administration pages" Drupal permission. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/node/2337623 - https://www.drupal.org/node/2344363
CVE ID: CVE-2014-9024 State: PUBLISHED Published: 2014-11-20T17:00:00Z Last Updated: 2024-09-17T01:26:45.543Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Protected Pages module 7.x-2.x before 7.x-2.4 for Drupal allows remote attackers to bypass the password protection via a crafted path. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/node/2353451 - https://www.drupal.org/node/2378279
CVE ID: CVE-2014-9025 State: PUBLISHED Published: 2014-11-20T17:00:00Z Last Updated: 2024-09-16T23:15:42.664Z Vendors: n/a Products: n/a Problem Types: n/a Description: The default checkout completion rule in the commerce_order module in the Drupal Commerce module 7.x-1.x before 7.x-1.10 for Drupal uses the email address as the username for new accounts created at checkout, which allows remote attackers to obtain sensitive information via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/node/2336327 - https://www.drupal.org/node/2336357
CVE ID: CVE-2014-9026 State: PUBLISHED Published: 2014-11-20T17:00:00Z Last Updated: 2024-09-16T16:48:17.015Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Ubercart module 7.x-3.x before 7.x-3.7 for Drupal does not properly protect the per-user order history view, which allows remote authenticated users with the "view own orders" permission to obtain sensitive information via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/node/2336259 - https://www.drupal.org/node/2336109
CVE ID: CVE-2014-9027 State: PUBLISHED Published: 2014-11-20T17:00:00 Last Updated: 2024-08-06T13:33:13.353Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in ZTE ZXDSL 831CII allow remote attackers to hijack the authentication of administrators for requests that disable modem lan ports via the (1) enblftp, (2) enblhttp, (3) enblsnmp, (4) enbltelnet, (5) enbltftp, (6) enblicmp, or (7) enblssh parameter to accesslocal.cmd. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/98590 - http://packetstormsecurity.com/files/129041
CVE ID: CVE-2014-9028 State: PUBLISHED Published: 2014-11-26T15:00:00 Last Updated: 2024-08-06T13:33:13.414Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in stream_decoder.c in libFLAC before 1.3.1 allows remote attackers to execute arbitrary code via a crafted .flac file. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2015-0767.html - http://packetstormsecurity.com/files/129261/libFLAC-1.3.0-Stack-Overflow-Heap-Overflow-Code-Execution.html - http://www.ubuntu.com/usn/USN-2426-1 - http://www.securityfocus.com/archive/1/534083/100/0/threaded - http://www.mandriva.com/security/advisories?name=MDVSA-201
ttp://www.securityfocus.com/archive/1/534083/100/0/threaded - http://www.mandriva.com/security/advisories?name=MDVSA-2015:188 - http://www.debian.org/security/2014/dsa-3082 - https://git.xiph.org/?p=flac.git%3Ba=commit%3Bh=fcf0ba06ae12ccd7c67cee3c8d948df15f946b85 - http://advisories.mageia.org/MGASA-2014-0499.html - http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html - http://www.mandriva.com/security/advisories?name=MDVSA-2014:239 - http://lists.opensuse.org/opensuse-updates/2014-12/msg00034.html - http://www.ocert.org/advisories/ocert-2014-008.html - http://www.securityfocus.com/bid/71282
CVE ID: CVE-2014-9029 State: PUBLISHED Published: 2014-12-08T16:00:00 Last Updated: 2024-08-06T13:33:13.412Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple off-by-one errors in the (1) jpc_dec_cp_setfromcox and (2) jpc_dec_cp_setfromrgn functions in jpc/jpc_dec.c in JasPer 1.900.1 and earlier allow remote attackers to execute arbitrary code via a crafted jp2 file, which triggers a heap-based buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2014/12/04/9 - http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html - http://www.ocert.org/advisories/ocert-2014-009.html - https://exch
chnetwork/security-advisory/cpujul2018-4258247.html - http://www.ocert.org/advisories/ocert-2014-009.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/99125 - http://advisories.mageia.org/MGASA-2014-0514.html - http://www.ubuntu.com/usn/USN-2434-1 - http://www.ubuntu.com/usn/USN-2434-2 - http://www.securityfocus.com/bid/71476 - http://www.mandriva.com/security/advisories?name=MDVSA-2014:247 - http://secunia.com/advisories/61747 - http://secunia.com/advisories/62828 - http://www.securityfocus.com/archive/1/534153/100/0/threaded - http://packetstormsecurity.com/files/129393/JasPer-1.900.1-Buffer-Overflow.html - http://rhn.redhat.com/errata/RHSA-2015-0698.html - https://bugzilla.redha
s/129393/JasPer-1.900.1-Buffer-Overflow.html - http://rhn.redhat.com/errata/RHSA-2015-0698.html - https://bugzilla.redhat.com/show_bug.cgi?id=1167537 - http://rhn.redhat.com/errata/RHSA-2014-2021.html - http://www.debian.org/security/2014/dsa-3089 - http://www.slackware.com/security/viewer.php?l=slackware-security&y=2015&m=slackware-security.538606 - http://www.mandriva.com/security/advisories?name=MDVSA-2015:159
CVE ID: CVE-2014-9030 State: PUBLISHED Published: 2014-11-24T15:00:00 Last Updated: 2024-08-06T13:33:13.540Z Vendors: n/a Products: n/a Problem Types: n/a Description: The do_mmu_update function in arch/x86/mm.c in Xen 3.2.x through 4.4.x does not properly manage page references, which allows remote domains to cause a denial of service by leveraging control over an HVM guest and a crafted MMU_MACHPHYS_UPDATE. Additional Analyst Notes: - CVE Program Container: References: - http://xenbits.xen.org/xsa/advisory-113.html - https://security.gentoo.org/glsa/201504-04 - http://secunia.com/advisories/62672 - https://exchange.xforce.ibmcloud.com/vulnerabilities/98853 - http://www.debian.org/security/
unia.com/advisories/62672 - https://exchange.xforce.ibmcloud.com/vulnerabilities/98853 - http://www.debian.org/security/2015/dsa-3140 - http://www.securityfocus.com/bid/71207 - http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00005.html - http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00010.html
CVE ID: CVE-2014-9031 State: PUBLISHED Published: 2014-11-25T23:00:00 Last Updated: 2024-08-06T13:33:13.369Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the wptexturize function in WordPress before 3.7.5, 3.8.x before 3.8.5, and 3.9.x before 3.9.3 allows remote attackers to inject arbitrary web script or HTML via crafted use of shortcode brackets in a text field, as demonstrated by a comment or a post. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2014/Nov/62 - http://www.debian.org/security/2014/dsa-3085 - http://openwall.com/lists/oss-security/2014/11/25/12 - http://advisories.m
ttp://www.debian.org/security/2014/dsa-3085 - http://openwall.com/lists/oss-security/2014/11/25/12 - http://advisories.mageia.org/MGASA-2014-0493.html - http://klikki.fi/adv/wordpress.html - http://www.securitytracker.com/id/1031243 - http://www.securityfocus.com/bid/71237 - http://www.mandriva.com/security/advisories?name=MDVSA-2014:233 - https://wordpress.org/news/2014/11/wordpress-4-0-1/
CVE ID: CVE-2014-9032 State: PUBLISHED Published: 2014-11-25T23:00:00 Last Updated: 2024-08-06T13:33:13.366Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the media-playlists feature in WordPress before 3.9.x before 3.9.3 and 4.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://openwall.com/lists/oss-security/2014/11/25/12 - http://advisories.mageia.org/MGASA-2014-0493.html - http://www.securitytracker.com/id/1031243 - http://www.securityfocus.com/bid/71236 - http://www.mandriva.com/security/advisories?name=MDVSA-
racker.com/id/1031243 - http://www.securityfocus.com/bid/71236 - http://www.mandriva.com/security/advisories?name=MDVSA-2014:233 - https://wordpress.org/news/2014/11/wordpress-4-0-1/
CVE ID: CVE-2014-9033 State: PUBLISHED Published: 2014-11-25T23:00:00 Last Updated: 2024-08-06T13:33:13.381Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in wp-login.php in WordPress 3.7.4, 3.8.4, 3.9.2, and 4.0 allows remote attackers to hijack the authentication of arbitrary users for requests that reset passwords. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2014/dsa-3085 - http://core.trac.wordpress.org/changeset/30418 - http://openwall.com/lists/oss-security/2014/11/25/12 - http://advisories.mageia.org/MGASA-2014-0493.html - http://www.securitytracker.com/id/1031243 - http://
/2014/11/25/12 - http://advisories.mageia.org/MGASA-2014-0493.html - http://www.securitytracker.com/id/1031243 - http://www.mandriva.com/security/advisories?name=MDVSA-2014:233 - https://wordpress.org/news/2014/11/wordpress-4-0-1/
CVE ID: CVE-2014-9034 State: PUBLISHED Published: 2014-11-25T23:00:00 Last Updated: 2024-08-06T13:33:13.361Z Vendors: n/a Products: n/a Problem Types: n/a Description: wp-includes/class-phpass.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to cause a denial of service (CPU consumption) via a long password that is improperly handled during hashing, a similar issue to CVE-2014-9016. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2014/dsa-3085 - http://openwall.com/lists/oss-security/2014/11/25/12 - http://core.trac.wordpress.org/changeset/30467 - http://advisories.mageia.org/MG
.com/lists/oss-security/2014/11/25/12 - http://core.trac.wordpress.org/changeset/30467 - http://advisories.mageia.org/MGASA-2014-0493.html - http://www.securitytracker.com/id/1031243 - http://www.mandriva.com/security/advisories?name=MDVSA-2014:233 - https://wordpress.org/news/2014/11/wordpress-4-0-1/