Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2014-5208 State: PUBLISHED Published: 2014-12-22T17:00:00 Last Updated: 2024-08-06T11:41:47.467Z Vendors: n/a Products: n/a Problem Types: n/a Description: BKBCopyD.exe in the Batch Management Packages in Yokogawa CENTUM CS 3000 through R3.09.50 and CENTUM VP through R4.03.00 and R5.x through R5.04.00, and Exaopc through R3.72.10, does not require authentication, which allows remote attackers to read arbitrary files via a RETR operation, write to arbitrary files via a STOR operation, or obtain sensitive database-location information via a PMODE operation, a different vulnerability than CVE-2014-0784. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cer
erent vulnerability than CVE-2014-0784. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-14-260-01A - http://www.yokogawa.com/dcs/security/ysar/YSAR-14-0003E.pdf - https://community.rapid7.com/community/metasploit/blog/2014/08/09/r7-2014-10-disclosure-yokogawa-centum-cs3000-bkbcopydexe-file-system-access
CVE ID: CVE-2014-5209 State: PUBLISHED Published: 2020-01-08T00:29:42 Last Updated: 2024-08-06T11:41:47.478Z Vendors: NTP Products: NTP Problem Types: information disclosure Description: An Information Disclosure vulnerability exists in NTP 4.2.7p25 private (mode 6/7) messages via a GET_RESTRICT control message, which could let a malicious user obtain sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K44942017 - https://support.f5.com/csp/article/K44942017?utm_source=f5support&amp%3Butm_medium=RSS - https://exchange.xforce.ibmcloud.com/vulnerabilities/95841 - https://support.f5.com/csp/article/K44942017
CVE ID: CVE-2014-5210 State: PUBLISHED Published: 2014-08-21T14:00:00 Last Updated: 2024-08-06T11:41:47.687Z Vendors: n/a Products: n/a Problem Types: n/a Description: The av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows remote attackers to execute arbitrary commands via a crafted (1) remote_task or (2) get_license request, a different vulnerability than CVE-2014-3804 and CVE-2014-3805. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/69239 - http://www.zerodayinitiative.com/advisories/ZDI-14-294/ - http://forums.alienvault.com/discussion/2690 - http://www.zerodayinitiative.com/advisories/ZDI-14-295/
CVE ID: CVE-2014-5211 State: PUBLISHED Published: 2015-01-27T15:00:00 Last Updated: 2024-08-06T11:41:48.264Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in the Attachmate Reflection FTP Client before 14.1.433 allows remote FTP servers to execute arbitrary code via a large PWD response. Additional Analyst Notes: - CVE Program Container: References: - http://support.attachmate.com/techdocs/1708.html - http://support.attachmate.com/techdocs/2501.html - http://support.attachmate.com/techdocs/2502.html - http://secunia.com/advisories/62467 - http://support.attachmate.com/techdocs/2288.html - http://www.zerodayinitiative.com/advisories/ZDI-15-008/
CVE ID: CVE-2014-5212 State: PUBLISHED Published: 2014-12-19T18:00:00 Last Updated: 2024-08-06T11:41:47.820Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in nds/search/data in iMonitor in Novell eDirectory before 8.8 SP8 Patch 4 allows remote attackers to inject arbitrary web script or HTML via the rdn parameter. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.novell.com/show_bug.cgi?id=904134 - http://www.securityfocus.com/archive/1/534284 - http://www.securitytracker.com/id/1031408 - https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20141219-0_NetIQ_eDirectory_iMonitor_XSS_Memory_D
https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20141219-0_NetIQ_eDirectory_iMonitor_XSS_Memory_Disclosure_v10.txt - https://www.novell.com/support/kb/doc.php?id=3426981
CVE ID: CVE-2014-5213 State: PUBLISHED Published: 2014-12-19T18:00:00 Last Updated: 2024-08-06T11:41:47.577Z Vendors: n/a Products: n/a Problem Types: n/a Description: nds/files/opt/novell/eDirectory/lib64/ndsimon/public/images in iMonitor in Novell eDirectory before 8.8 SP8 Patch 4 allows remote authenticated users to obtain sensitive information from process memory via a direct request. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/534284 - http://www.securitytracker.com/id/1031408 - https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20141219-0_NetIQ_eDirectory_iMonitor_XSS_Memory_Disclosure_v10.txt - https://www
ata/seccons/prod/temedia/advisories_txt/20141219-0_NetIQ_eDirectory_iMonitor_XSS_Memory_Disclosure_v10.txt - https://www.novell.com/support/kb/doc.php?id=3426981 - https://bugzilla.novell.com/show_bug.cgi?id=904135
CVE ID: CVE-2014-5214 State: PUBLISHED Published: 2014-12-23T11:00:00 Last Updated: 2024-08-06T11:41:48.328Z Vendors: n/a Products: n/a Problem Types: n/a Description: nps/servlet/webacc in iManager in the Administration Console server in NetIQ Access Manager (NAM) 4.x before 4.0.1 HF3 allows remote authenticated novlwww users to read arbitrary files via a query parameter containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2014/Dec/78 - https://www.novell.com/support/kb/doc.php?id=7015993 - https://www.sec-consul
/seclists.org/fulldisclosure/2014/Dec/78 - https://www.novell.com/support/kb/doc.php?id=7015993 - https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20141218-2_Novell_NetIQ_Access_Manager_Multiple_Vulnerabilities_v10.txt - http://packetstormsecurity.com/files/129658/NetIQ-Access-Manager-4.0-SP1-XSS-CSRF-XXE-Injection-Disclosure.html
CVE ID: CVE-2014-5215 State: PUBLISHED Published: 2014-12-23T11:00:00 Last Updated: 2024-08-06T11:41:48.496Z Vendors: n/a Products: n/a Problem Types: n/a Description: NetIQ Access Manager (NAM) 4.x before 4.0.1 HF3 allows remote authenticated administrators to discover service-account passwords via a request to (1) roma/jsp/volsc/monitoring/dev_services.jsp or (2) roma/jsp/debug/debug.jsp. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2014/Dec/78 - https://www.novell.com/support/kb/doc.php?id=7015995 - https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20141218-2_Novell_NetIQ_Access_Manager_Multiple_Vulnerabilities_v1
onsult.com/fxdata/seccons/prod/temedia/advisories_txt/20141218-2_Novell_NetIQ_Access_Manager_Multiple_Vulnerabilities_v10.txt - http://packetstormsecurity.com/files/129658/NetIQ-Access-Manager-4.0-SP1-XSS-CSRF-XXE-Injection-Disclosure.html
CVE ID: CVE-2014-5216 State: PUBLISHED Published: 2014-12-23T11:00:00 Last Updated: 2024-08-06T11:41:47.773Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in NetIQ Access Manager (NAM) 4.x before 4.0.1 HF3 allow remote attackers to inject arbitrary web script or HTML via (1) the location parameter in a dev.Empty action to nps/servlet/webacc, (2) the error parameter to nidp/jsp/x509err.jsp, (3) the lang parameter to sslvpn/applet_agent.jsp, or (4) the secureLoggingServersA parameter to roma/system/cntl, a different issue than CVE-2014-9412. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/full
rent issue than CVE-2014-9412. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2014/Dec/78 - https://www.novell.com/support/kb/doc.php?id=7015996 - https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20141218-2_Novell_NetIQ_Access_Manager_Multiple_Vulnerabilities_v10.txt - https://www.novell.com/support/kb/doc.php?id=7015994 - http://packetstormsecurity.com/files/129658/NetIQ-Access-Manager-4.0-SP1-XSS-CSRF-XXE-Injection-Disclosure.html
CVE ID: CVE-2014-5217 State: PUBLISHED Published: 2014-12-23T11:00:00 Last Updated: 2024-08-06T11:41:47.654Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in nps/servlet/webacc in the Administration Console server in NetIQ Access Manager (NAM) 4.x before 4.1 allows remote attackers to hijack the authentication of administrators for requests that change the administrative password via an fw.SetPassword action. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2014/Dec/78 - https://www.novell.com/support/kb/doc.php?id=7015997 - https://www.sec-consult.com/fxdata/seccons/prod/temedia/a
ec/78 - https://www.novell.com/support/kb/doc.php?id=7015997 - https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20141218-2_Novell_NetIQ_Access_Manager_Multiple_Vulnerabilities_v10.txt - http://packetstormsecurity.com/files/129658/NetIQ-Access-Manager-4.0-SP1-XSS-CSRF-XXE-Injection-Disclosure.html
CVE ID: CVE-2014-5220 State: PUBLISHED Published: 2018-06-08T17:00:00 Last Updated: 2024-08-06T11:41:47.691Z Vendors: n/a Products: n/a Problem Types: n/a Description: The mdcheck script of the mdadm package for openSUSE 13.2 prior to version 3.3.1-5.14.1 does not properly sanitize device names, which allows local attackers to execute arbitrary commands as root. Additional Analyst Notes: - CVE Program Container: References: - https://lists.opensuse.org/opensuse-updates/2015-02/msg00069.html - https://bugzilla.suse.com/show_bug.cgi?id=910500
CVE ID: CVE-2014-5221 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2021-01-06T16:15:23 Description: No description available.
CVE ID: CVE-2014-5222 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2021-01-06T16:15:43 Description: No description available.
CVE ID: CVE-2014-5223 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2021-01-06T16:15:34 Description: No description available.
CVE ID: CVE-2014-5224 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2021-01-06T16:15:36 Description: No description available.
CVE ID: CVE-2014-5225 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2021-01-06T16:16:05 Description: No description available.
CVE ID: CVE-2014-5226 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2021-01-06T16:15:32 Description: No description available.
CVE ID: CVE-2014-5227 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2021-01-06T16:15:28 Description: No description available.
CVE ID: CVE-2014-5228 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2021-01-06T16:15:57 Description: No description available.
CVE ID: CVE-2014-5229 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2021-01-06T16:15:25 Description: No description available.
CVE ID: CVE-2014-5230 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2021-01-06T16:15:34 Description: No description available.
CVE ID: CVE-2014-5231 State: PUBLISHED Published: 2015-01-14T11:00:00 Last Updated: 2024-08-06T11:41:48.483Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Siemens SIMATIC WinCC Sm@rtClient app before 1.0.2 for iOS allows physically proximate attackers to extract the password from storage via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-311299.pdf - http://www.securitytracker.com/id/1031546
CVE ID: CVE-2014-5232 State: PUBLISHED Published: 2015-01-14T11:00:00 Last Updated: 2024-08-06T11:41:47.833Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Siemens SIMATIC WinCC Sm@rtClient app before 1.0.2 for iOS allows local users to bypass an intended application-password requirement by leveraging the running of the app in the background state. Additional Analyst Notes: - CVE Program Container: References: - http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-311299.pdf - http://www.securitytracker.com/id/1031546
CVE ID: CVE-2014-5233 State: PUBLISHED Published: 2015-01-14T11:00:00 Last Updated: 2024-08-06T11:41:47.650Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Siemens SIMATIC WinCC Sm@rtClient app before 1.0.2 for iOS allows physically proximate attackers to discover Sm@rtServer credentials by leveraging an error in the credential-processing mechanism. Additional Analyst Notes: - CVE Program Container: References: - http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-311299.pdf - http://www.securitytracker.com/id/1031546
CVE ID: CVE-2014-5234 State: PUBLISHED Published: 2014-09-17T14:00:00 Last Updated: 2024-08-06T11:41:47.809Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the backend in Open-Xchange (OX) AppSuite before 7.4.2-rev33 and 7.6.x before 7.6.0-rev16 allows remote attackers to inject arbitrary web script or HTML via a folder publication name. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/533443/100/0/threaded - http://www.securityfocus.com/bid/69796 - http://secunia.com/advisories/61080 - http://packetstormsecurity.com/files/128257/Open-Xchange-7.6.0-XSS-SSRF-Traversal.html - http://s
com/advisories/61080 - http://packetstormsecurity.com/files/128257/Open-Xchange-7.6.0-XSS-SSRF-Traversal.html - http://software.open-xchange.com/OX6/doc/Release_Notes_for_Patch_Release_2112_7.6.0_2014-08-25.pdf
CVE ID: CVE-2014-5235 State: PUBLISHED Published: 2014-09-17T14:00:00 Last Updated: 2024-08-06T11:41:48.496Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the frontend in Open-Xchange (OX) AppSuite before 7.4.2-rev33 and 7.6.x before 7.6.0-rev16 allows remote attackers to inject arbitrary web script or HTML via vectors related to unspecified fields in RSS feeds. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/69792 - http://www.securityfocus.com/archive/1/533443/100/0/threaded - http://secunia.com/advisories/61080 - http://packetstormsecurity.com/files/128257/Open-Xchange-7.6.0-XSS-SSRF
threaded - http://secunia.com/advisories/61080 - http://packetstormsecurity.com/files/128257/Open-Xchange-7.6.0-XSS-SSRF-Traversal.html - http://software.open-xchange.com/OX6/doc/Release_Notes_for_Patch_Release_2112_7.6.0_2014-08-25.pdf
CVE ID: CVE-2014-5236 State: PUBLISHED Published: 2020-01-31T21:16:52 Last Updated: 2024-08-06T11:41:48.270Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple absolute path traversal vulnerabilities in documentconverter in Open-Xchange (OX) AppSuite before 7.4.2-rev10 and 7.6.x before 7.6.0-rev10 allow remote attackers to read application files via a full pathname in a crafted (1) OLE Object or (2) image in an OpenDocument text file. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/128257/Open-Xchange-7.6.0-XSS-SSRF-Traversal.html - http://www.securityfocus.com/archive/1/archive/1/533443/100/0/threaded - http://software.o
6.0-XSS-SSRF-Traversal.html - http://www.securityfocus.com/archive/1/archive/1/533443/100/0/threaded - http://software.open-xchange.com/OX6/doc/Release_Notes_for_Patch_Release_2112_7.6.0_2014-08-25.pdf
CVE ID: CVE-2014-5237 State: PUBLISHED Published: 2014-12-01T15:00:00 Last Updated: 2024-08-06T11:41:47.695Z Vendors: n/a Products: n/a Problem Types: n/a Description: Server-side request forgery (SSRF) vulnerability in the documentconverter component in Open-Xchange (OX) AppSuite before 7.4.2-rev10 and 7.6.x before 7.6.0-rev10 allows remote attackers to trigger requests to arbitrary servers and embed arbitrary images via a URL in an embedded image in a Text document, which is not properly handled by the image preview. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/533443/100/0/threaded - http://packetstormsecurity.com/files/128257/Ope
rences: - http://www.securityfocus.com/archive/1/533443/100/0/threaded - http://packetstormsecurity.com/files/128257/Open-Xchange-7.6.0-XSS-SSRF-Traversal.html - http://software.open-xchange.com/OX6/doc/Release_Notes_for_Patch_Release_2112_7.6.0_2014-08-25.pdf
CVE ID: CVE-2014-5238 State: PUBLISHED Published: 2020-01-14T16:00:29 Last Updated: 2024-08-06T11:41:47.807Z Vendors: n/a Products: n/a Problem Types: n/a Description: XML external entity (XXE) vulnerability in Open-Xchange (OX) AppSuite before 7.4.2-rev11 and 7.6.x before 7.6.0-rev9 allows remote attackers to read arbitrary files and possibly other unspecified impact via a crafted OpenDocument Text document. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/128257/Open-Xchange-7.6.0-XSS-SSRF-Traversal.html - http://www.securityfocus.com/archive/1/archive/1/533443/100/0/threaded - http://software.open-xchange.com/OX6/doc/Release_Notes_for_P
curityfocus.com/archive/1/archive/1/533443/100/0/threaded - http://software.open-xchange.com/OX6/doc/Release_Notes_for_Patch_Release_2112_7.6.0_2014-08-25.pdf
CVE ID: CVE-2014-5239 State: PUBLISHED Published: 2014-08-14T01:00:00 Last Updated: 2024-08-06T11:41:47.691Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Microsoft Outlook.com application before 7.8.2.12.49.7090 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1030733 - http://jvn.jp/en/jp/JVN72950786/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2014-000086
CVE ID: CVE-2014-5240 State: PUBLISHED Published: 2014-08-18T10:00:00 Last Updated: 2024-08-06T11:41:47.780Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in wp-includes/pluggable.php in WordPress before 3.9.2, when Multisite is enabled, allows remote authenticated administrators to inject arbitrary web script or HTML, and obtain Super Admin privileges, via a crafted avatar URL. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2014/dsa-3001 - https://wordpress.org/news/2014/08/wordpress-3-9-2/ - https://core.trac.wordpress.org/changeset/29398 - http://openwall.com/lists/oss-security/2014/08/1
08/wordpress-3-9-2/ - https://core.trac.wordpress.org/changeset/29398 - http://openwall.com/lists/oss-security/2014/08/13/3
CVE ID: CVE-2014-5241 State: PUBLISHED Published: 2014-08-22T17:00:00 Last Updated: 2024-08-06T11:41:47.649Z Vendors: n/a Products: n/a Problem Types: n/a Description: The JSONP endpoint in includes/api/ApiFormatJson.php in MediaWiki before 1.19.18, 1.20.x through 1.22.x before 1.22.9, and 1.23.x before 1.23.2 accepts certain long callback values and does not restrict the initial bytes of a JSONP response, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks, and obtain sensitive information, via a crafted OBJECT element with SWF content consistent with a restricted character set. Additional Analyst Notes: - CVE Program Container: References: - https://lists.wik
tent with a restricted character set. Additional Analyst Notes: - CVE Program Container: References: - https://lists.wikimedia.org/pipermail/mediawiki-announce/2014-July/000157.html - http://www.debian.org/security/2014/dsa-3011 - http://www.mandriva.com/security/advisories?name=MDVSA-2014:153 - http://secunia.com/advisories/59738 - https://bugzilla.wikimedia.org/show_bug.cgi?id=68187 - http://openwall.com/lists/oss-security/2014/08/14/5 - http://advisories.mageia.org/MGASA-2014-0309.html
CVE ID: CVE-2014-5242 State: PUBLISHED Published: 2014-08-22T17:00:00 Last Updated: 2024-08-06T11:41:48.075Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in mediawiki.page.image.pagination.js in MediaWiki 1.22.x before 1.22.9 and 1.23.x before 1.23.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving the multipageimagenavbox class in conjunction with an action=raw value. Additional Analyst Notes: - CVE Program Container: References: - https://lists.wikimedia.org/pipermail/mediawiki-announce/2014-July/000157.html - https://bugzilla.wikimedia.org/show_bug.cgi?id=66608 - http://www.mandriva.com/security/adv
unce/2014-July/000157.html - https://bugzilla.wikimedia.org/show_bug.cgi?id=66608 - http://www.mandriva.com/security/advisories?name=MDVSA-2014:153 - http://www.securityfocus.com/bid/69135 - http://openwall.com/lists/oss-security/2014/08/14/5 - http://advisories.mageia.org/MGASA-2014-0309.html
CVE ID: CVE-2014-5243 State: PUBLISHED Published: 2014-08-22T17:00:00 Last Updated: 2024-08-06T11:41:48.324Z Vendors: n/a Products: n/a Problem Types: n/a Description: MediaWiki before 1.19.18, 1.20.x through 1.22.x before 1.22.9, and 1.23.x before 1.23.2 does not enforce an IFRAME protection mechanism for transcluded pages, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site. Additional Analyst Notes: - CVE Program Container: References: - https://lists.wikimedia.org/pipermail/mediawiki-announce/2014-July/000157.html - http://www.debian.org/security/2014/dsa-3011 - http://www.mandriva.com/security/advisories?name=MDVSA-2014:153 - http://secunia.
ww.debian.org/security/2014/dsa-3011 - http://www.mandriva.com/security/advisories?name=MDVSA-2014:153 - http://secunia.com/advisories/59738 - http://openwall.com/lists/oss-security/2014/08/14/5 - https://bugzilla.wikimedia.org/show_bug.cgi?id=65778 - http://advisories.mageia.org/MGASA-2014-0309.html
CVE ID: CVE-2014-5246 State: PUBLISHED Published: 2014-08-22T14:00:00 Last Updated: 2024-08-06T11:41:47.875Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Shenzhen Tenda Technology Tenda A5s router with firmware 3.02.05_CN allows remote attackers to bypass authentication and gain administrator access by setting the admin:language cookie to zh-cn. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/127905/Tenda-A5s-Router-Authentication-Bypass.html - http://www.exploit-db.com/exploits/34361 - https://exchange.xforce.ibmcloud.com/vulnerabilities/95337 - http://osvdb.org/show/osvdb/110146 - http://www.securityfocus.com/bid/69267
CVE ID: CVE-2014-5247 State: PUBLISHED Published: 2014-08-29T17:00:00 Last Updated: 2024-08-06T11:41:48.270Z Vendors: n/a Products: n/a Problem Types: n/a Description: The _UpgradeBeforeConfigurationChange function in lib/client/gnt_cluster.py in Ganeti 2.10.0 before 2.10.7 and 2.11.0 before 2.11.5 uses world-readable permissions for the configuration backup file, which allows local users to obtain SSL keys, remote API credentials, and other sensitive information by reading the file, related to the upgrade command. Additional Analyst Notes: - CVE Program Container: References: - http://git.ganeti.org/?p=ganeti.git%3Ba=commit%3Bh=a89f62e2db9ccf715d64d1a6322474b54d2d9ae0 - https://exchange.xfo
es: - http://git.ganeti.org/?p=ganeti.git%3Ba=commit%3Bh=a89f62e2db9ccf715d64d1a6322474b54d2d9ae0 - https://exchange.xforce.ibmcloud.com/vulnerabilities/95256 - http://packetstormsecurity.com/files/127851/Ganeti-Insecure-Archive-Permission.html - http://www.securityfocus.com/archive/1/533119/100/0/threaded - http://www.securityfocus.com/bid/69186 - http://seclists.org/oss-sec/2014/q3/370 - http://www.ocert.org/advisories/ocert-2014-006.html
CVE ID: CVE-2014-5248 State: PUBLISHED Published: 2014-08-14T18:00:00Z Last Updated: 2024-09-16T21:04:27.064Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in MyBB before 1.6.15 allows remote attackers to inject arbitrary web script or HTML via vectors related to video MyCode. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/59707 - http://blog.mybb.com/2014/08/04/mybb-1-6-15-released-security-maintenance-release