Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2014-5249 State: PUBLISHED Published: 2014-08-14T18:00:00 Last Updated: 2024-08-06T11:41:47.837Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the "Biblio self autocomplete" submodule in the Biblio Autocomplete module 6.x-1.x before 6.x-1.1 and 7.x-1.x before 7.x-1.5 for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/69091 - https://www.drupal.org/node/2316717 - https://www.drupal.org/node/2316025 - https://www.drupal.org/node/2316023 - https://exchange.xforce.ibmcloud.com/vulnerabilities/95146
CVE ID: CVE-2014-5250 State: PUBLISHED Published: 2014-08-14T18:00:00Z Last Updated: 2024-09-17T01:47:09.735Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in the AJAX autocompletion callback in the Biblio Autocomplete module 6.x-1.x before 6.x-1.1 and 7.x-1.x before 7.x-1.5 for Drupal allows remote attackers to access data via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/69091 - https://www.drupal.org/node/2316717 - https://www.drupal.org/node/2316025 - https://www.drupal.org/node/2316023
CVE ID: CVE-2014-5251 State: PUBLISHED Published: 2014-08-25T14:00:00 Last Updated: 2024-08-06T11:41:47.701Z Vendors: n/a Products: n/a Problem Types: n/a Description: The MySQL token driver in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 stores timestamps with the incorrect precision, which causes the expiration comparison for tokens to fail and allows remote authenticated users to retain access via an expired token. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2014-1121.html - http://rhn.redhat.com/errata/RHSA-2014-1122.html - https://bugs.launchpad.net/keystone/+bug/1347961 - http://www.ubuntu.com/usn
rhn.redhat.com/errata/RHSA-2014-1122.html - https://bugs.launchpad.net/keystone/+bug/1347961 - http://www.ubuntu.com/usn/USN-2324-1 - http://www.openwall.com/lists/oss-security/2014/08/15/6
CVE ID: CVE-2014-5252 State: PUBLISHED Published: 2014-08-25T14:00:00 Last Updated: 2024-08-06T11:41:47.761Z Vendors: n/a Products: n/a Problem Types: n/a Description: The V3 API in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 updates the issued_at value for UUID v2 tokens, which allows remote authenticated users to bypass the token expiration and retain access via a verification (1) GET or (2) HEAD request to v3/auth/tokens/. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2014-1121.html - http://rhn.redhat.com/errata/RHSA-2014-1122.html - http://www.ubuntu.com/usn/USN-2324-1 - https://bugs.launchpad.net/k
- http://rhn.redhat.com/errata/RHSA-2014-1122.html - http://www.ubuntu.com/usn/USN-2324-1 - https://bugs.launchpad.net/keystone/+bug/1348820 - http://www.openwall.com/lists/oss-security/2014/08/15/6
CVE ID: CVE-2014-5253 State: PUBLISHED Published: 2014-08-25T14:00:00 Last Updated: 2024-08-06T11:41:48.330Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 does not properly revoke tokens when a domain is invalidated, which allows remote authenticated users to retain access via a domain-scoped token for that domain. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/keystone/+bug/1349597 - http://rhn.redhat.com/errata/RHSA-2014-1121.html - http://rhn.redhat.com/errata/RHSA-2014-1122.html - http://www.ubuntu.com/usn/USN-2324-1 - http://www.openwall.com/lists/oss
p://rhn.redhat.com/errata/RHSA-2014-1122.html - http://www.ubuntu.com/usn/USN-2324-1 - http://www.openwall.com/lists/oss-security/2014/08/15/6
CVE ID: CVE-2014-5254 State: PUBLISHED Published: 2019-11-21T22:26:47 Last Updated: 2024-08-06T11:41:48.502Z Vendors: xcfa Products: xcfa Problem Types: Symbolic Link Following Description: xcfa before 5.0.1 creates temporary files insecurely which could allow local users to launch a symlink attack and overwrite arbitrary files. Additional Analyst Notes: - CVE Program Container: References: - https://security-tracker.debian.org/tracker/CVE-2014-5254 - https://exchange.xforce.ibmcloud.com/vulnerabilities/95331 - http://www.openwall.com/lists/oss-security/2014/08/15/4 - http://www.securityfocus.com/bid/69020 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=756600
CVE ID: CVE-2014-5255 State: PUBLISHED Published: 2019-11-21T22:30:50 Last Updated: 2024-08-06T11:41:47.838Z Vendors: xcfa Products: xcfa Problem Types: Symbolic Link Following Description: xcfa before 5.0.1 creates temporary files insecurely which could allow local users to launch a symlink attack and overwrite arbitrary files. Note: A different vulnerability than CVE-2014-5254. Additional Analyst Notes: - CVE Program Container: References: - https://security-tracker.debian.org/tracker/CVE-2014-5255 - http://www.openwall.com/lists/oss-security/2014/08/15/4 - http://www.securityfocus.com/bid/69020 - https://bugs.gentoo.org/show_bug.cgi?id=CVE-2014-5255 - https://exchange.xforce.ibmcloud.com/
urityfocus.com/bid/69020 - https://bugs.gentoo.org/show_bug.cgi?id=CVE-2014-5255 - https://exchange.xforce.ibmcloud.com/vulnerabilities/95332 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=756600
CVE ID: CVE-2014-5256 State: PUBLISHED Published: 2014-09-05T17:00:00 Last Updated: 2024-08-06T11:41:48.492Z Vendors: n/a Products: n/a Problem Types: n/a Description: Node.js 0.8 before 0.8.28 and 0.10 before 0.10.30 does not consider the possibility of recursive processing that triggers V8 garbage collection in conjunction with a V8 interrupt, which allows remote attackers to cause a denial of service (memory corruption and application crash) via deep JSON objects whose parsing lets this interrupt mask an overflow of the program stack. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg21684769 - http://secunia.com/advisories/6
ram Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg21684769 - http://secunia.com/advisories/61260 - http://advisories.mageia.org/MGASA-2014-0516.html - https://github.com/joyent/node/commit/530af9cb8e700e7596b3ec812bad123c9fa06356 - http://blog.nodejs.org/2014/07/31/v8-memory-corruption-stack-overflow/ - http://www.mandriva.com/security/advisories?name=MDVSA-2015:142
CVE ID: CVE-2014-5257 State: PUBLISHED Published: 2014-11-06T15:00:00 Last Updated: 2024-08-06T11:41:48.308Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Forma Lms before 1.2.1 p01 allow remote attackers to inject arbitrary web script or HTML via the (1) id_custom parameter in an amanmenu request or (2) id_game parameter in an alms/games/edit request to appCore/index.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/70914 - http://www.securityfocus.com/archive/1/533905/100/0/threaded - http://packetstormsecurity.com/files/128978/Forma-Lms-1.2.1-Cross-Site-Scripting.html -
rchive/1/533905/100/0/threaded - http://packetstormsecurity.com/files/128978/Forma-Lms-1.2.1-Cross-Site-Scripting.html - http://sourceforge.net/projects/forma/files/version%201.x/formalms-v1.2.1-p01.zip/download - https://www.htbridge.com/advisory/HTB23226
CVE ID: CVE-2014-5258 State: PUBLISHED Published: 2014-11-06T18:00:00 Last Updated: 2024-08-06T11:41:47.830Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in showTempFile.php in webEdition CMS before 6.3.9.0 Beta allows remote authenticated users to read arbitrary files via a .. (dot dot) in the file parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.htbridge.com/advisory/HTB23227 - http://www.webedition.org/de/aktuelles/webedition-cms/webEdition-6.3.9-Beta-erschienen - http://www.securityfocus.com/archive/1/533465/100/0/threaded - http://packetstormsecurity.com/files/128301/webEdition-6.3.8.0-Path-Traversal.
cus.com/archive/1/533465/100/0/threaded - http://packetstormsecurity.com/files/128301/webEdition-6.3.8.0-Path-Traversal.html - http://www.webedition.org/de/webedition-cms/versionshistorie/webedition-6/version-6.3.9.0
CVE ID: CVE-2014-5259 State: PUBLISHED Published: 2014-09-12T14:00:00 Last Updated: 2024-08-06T11:41:47.655Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in cattranslate.php in the CatTranslate JQuery plugin in BlackCat CMS 1.0.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the msg parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/533336/100/0/threaded - http://www.securityfocus.com/bid/69551 - http://forum.blackcat-cms.org/viewtopic.php?f=2&t=263 - http://packetstormsecurity.com/files/128141/BlackCat-CMS-1.0.3-Cross-Site-Scripting.html - h
g/viewtopic.php?f=2&t=263 - http://packetstormsecurity.com/files/128141/BlackCat-CMS-1.0.3-Cross-Site-Scripting.html - https://www.htbridge.com/advisory/HTB23228 - https://exchange.xforce.ibmcloud.com/vulnerabilities/95717
CVE ID: CVE-2014-5260 State: PUBLISHED Published: 2014-08-16T01:00:00 Last Updated: 2024-08-06T11:41:48.228Z Vendors: n/a Products: n/a Problem Types: n/a Description: The (1) mkxmltype and (2) mkdtskel scripts in XML-DT before 0.64 allow local users to overwrite arbitrary files via a symlink attack on a /tmp/_xml_##### temporary file. Additional Analyst Notes: - CVE Program Container: References: - https://metacpan.org/source/AMBS/XML-DT-0.66/Changes - https://bugs.debian.org/756566 - https://metacpan.org/diff/file?target=AMBS/XML-DT-0.64/&source=AMBS/XML-DT-0.63/ - http://openwall.com/lists/oss-security/2014/08/15/8
CVE ID: CVE-2014-5261 State: PUBLISHED Published: 2014-08-22T14:00:00 Last Updated: 2024-08-06T11:41:47.992Z Vendors: n/a Products: n/a Problem Types: n/a Description: The graph settings script (graph_settings.php) in Cacti 0.8.8b and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a font size, related to the rrdtool commandline in lib/rrd.php. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201607-05 - http://www.debian.org/security/2014/dsa-3007 - https://bugzilla.redhat.com/show_bug.cgi?id=1127165 - http://seclists.org/oss-sec/2014/q3/351 - https://exchange.xforce.ibmcloud.com/vulnerabilities/95292
ug.cgi?id=1127165 - http://seclists.org/oss-sec/2014/q3/351 - https://exchange.xforce.ibmcloud.com/vulnerabilities/95292 - http://svn.cacti.net/viewvc?view=rev&revision=7454 - http://www.securityfocus.com/bid/69213 - http://seclists.org/oss-sec/2014/q3/386
CVE ID: CVE-2014-5262 State: PUBLISHED Published: 2014-08-22T14:00:00 Last Updated: 2024-08-06T11:41:48.329Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the graph settings script (graph_settings.php) in Cacti 0.8.8b and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201607-05 - http://www.debian.org/security/2014/dsa-3007 - https://bugzilla.redhat.com/show_bug.cgi?id=1127165 - http://seclists.org/oss-sec/2014/q3/351 - https://exchange.xforce.ibmcloud.com/vulnerabilities/95292 - http://svn.cacti.net/viewvc?v
sts.org/oss-sec/2014/q3/351 - https://exchange.xforce.ibmcloud.com/vulnerabilities/95292 - http://svn.cacti.net/viewvc?view=rev&revision=7454 - http://www.securityfocus.com/bid/69213 - http://seclists.org/oss-sec/2014/q3/386
CVE ID: CVE-2014-5263 State: PUBLISHED Published: 2014-08-26T14:00:00 Last Updated: 2024-08-06T11:41:48.490Z Vendors: n/a Products: n/a Problem Types: n/a Description: vmstate_xhci_event in hw/usb/hcd-xhci.c in QEMU 1.6.0 does not terminate the list with the VMSTATE_END_OF_LIST macro, which allows attackers to cause a denial of service (out-of-bounds access, infinite loop, and memory corruption) and possibly gain privileges via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2014/08/04/1 - https://bugzilla.redhat.com/show_bug.cgi?id=1126543 - http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=3afca1d6d413592c2b7
s://bugzilla.redhat.com/show_bug.cgi?id=1126543 - http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=3afca1d6d413592c2b78cf28f52fa24a586d8f56 - http://www.openwall.com/lists/oss-security/2014/08/16/1 - http://www.ubuntu.com/usn/USN-2409-1
CVE ID: CVE-2014-5265 State: PUBLISHED Published: 2014-08-18T10:00:00 Last Updated: 2024-08-06T11:41:47.838Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, permits entity declarations without considering recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2014/dsa-3001 - https://wordpres
al Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2014/dsa-3001 - https://wordpress.org/news/2014/08/wordpress-3-9-2/ - https://www.drupal.org/SA-CORE-2014-004 - http://cgit.drupalcode.org/drupal/diff/includes/xmlrpc.inc?id=1849830 - http://www.debian.org/security/2014/dsa-2999 - https://core.trac.wordpress.org/changeset/29404
CVE ID: CVE-2014-5266 State: PUBLISHED Published: 2014-08-18T10:00:00 Last Updated: 2024-08-06T11:41:47.672Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, does not limit the number of elements in an XML document, which allows remote attackers to cause a denial of service (CPU consumption) via a large document, a different vulnerability than CVE-2014-5265. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2014/dsa-3001 - https://wordpress.org/news/2014/08/wordpress-3-9-2/ - https://www.drupal.org/SA-CORE-2014-004 - http
ity/2014/dsa-3001 - https://wordpress.org/news/2014/08/wordpress-3-9-2/ - https://www.drupal.org/SA-CORE-2014-004 - http://cgit.drupalcode.org/drupal/diff/includes/xmlrpc.inc?id=1849830 - http://www.debian.org/security/2014/dsa-2999 - http://cgit.drupalcode.org/drupal/diff/modules/openid/xrds.inc?id=1849830 - https://core.trac.wordpress.org/changeset/29404
CVE ID: CVE-2014-5267 State: PUBLISHED Published: 2014-09-30T14:00:00 Last Updated: 2024-08-06T11:41:48.310Z Vendors: n/a Products: n/a Problem Types: n/a Description: modules/openid/xrds.inc in Drupal 6.x before 6.33 and 7.x before 7.31 allows remote attackers to have unspecified impact via a crafted DOCTYPE declaration in an XRDS document. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/SA-CORE-2014-004 - http://www.debian.org/security/2014/dsa-2999 - http://cgit.drupalcode.org/drupal/diff/modules/openid/xrds.inc?id=1849830 - http://openwall.com/lists/oss-security/2014/08/16/4
CVE ID: CVE-2014-5268 State: PUBLISHED Published: 2014-12-01T16:00:00 Last Updated: 2024-08-06T11:41:47.953Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Fasttoggle module 7.x-1.3 and 7.x-1.4 for Drupal allows remote attackers to block or unblock an account via a crafted user status link. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/node/2316747 - https://www.drupal.org/node/2316065
CVE ID: CVE-2014-5269 State: PUBLISHED Published: 2014-09-04T17:00:00 Last Updated: 2024-08-06T11:41:48.023Z Vendors: n/a Products: n/a Problem Types: n/a Description: Plack::App::File in Plack before 1.0031 removes trailing slash characters from paths, which allows remote attackers to bypass the whitelist of generated files and obtain sensitive information via a crafted path, related to Plack::Middleware::Static. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/oss-sec/2014/q3/384 - http://lists.fedoraproject.org/pipermail/package-announce/2014-August/137099.html - https://github.com/avar/Plack/commit/bc1731dbb53850c380875ad683cd87c8ec99eee3 - http://www.
ce/2014-August/137099.html - https://github.com/avar/Plack/commit/bc1731dbb53850c380875ad683cd87c8ec99eee3 - http://www.osvdb.org/109928 - https://github.com/plack/Plack/issues/405 - http://api.metacpan.org/source/MIYAGAWA/Plack-1.0031/Changes - http://lists.fedoraproject.org/pipermail/package-announce/2014-August/137115.html
CVE ID: CVE-2014-5270 State: PUBLISHED Published: 2014-10-10T01:00:00 Last Updated: 2024-08-06T11:41:47.780Z Vendors: n/a Products: n/a Problem Types: n/a Description: Libgcrypt before 1.5.4, as used in GnuPG and other products, does not properly perform ciphertext normalization and ciphertext randomization, which makes it easier for physically proximate attackers to conduct key-extraction attacks by leveraging the ability to collect voltage data from exposed metal, a different vector than CVE-2013-4576. Additional Analyst Notes: - CVE Program Container: References: - http://lists.gnupg.org/pipermail/gnupg-announce/2014q3/000352.html - http://www.debian.org/security/2014/dsa-3073 - http://op
//lists.gnupg.org/pipermail/gnupg-announce/2014q3/000352.html - http://www.debian.org/security/2014/dsa-3073 - http://openwall.com/lists/oss-security/2014/08/16/2 - http://www.cs.tau.ac.il/~tromer/handsoff/ - http://www.debian.org/security/2014/dsa-3024
CVE ID: CVE-2014-5271 State: PUBLISHED Published: 2014-11-03T16:00:00 Last Updated: 2024-08-06T11:41:47.864Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in the encode_slice function in libavcodec/proresenc_kostya.c in FFMpeg before 1.1.14, 1.2.x before 1.2.8, 2.x before 2.2.7, and 2.3.x before 2.3.3 and Libav before 10.5 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.osvdb.org/111725 - http://www.securityfocus.com/bid/69250 - http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=52b81ff4635c077b2bc8b8d36
http://www.securityfocus.com/bid/69250 - http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=52b81ff4635c077b2bc8b8d3637d933b6629d803 - https://security.gentoo.org/glsa/201603-06 - https://www.ffmpeg.org/security.html
CVE ID: CVE-2014-5272 State: PUBLISHED Published: 2014-11-03T16:00:00 Last Updated: 2024-08-06T11:41:47.823Z Vendors: n/a Products: n/a Problem Types: n/a Description: libavcodec/iff.c in FFMpeg before 1.1.14, 1.2.x before 1.2.8, 2.2.x before 2.2.7, and 2.3.x before 2.3.2 allows remote attackers to have unspecified impact via a crafted iff image, which triggers an out-of-bounds array access, related to the rgb8 and rgbn formats. Additional Analyst Notes: - CVE Program Container: References: - http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=abc1fa7c5a1dca1345b9471b81cfcda00c56220d - https://security.gentoo.org/glsa/201603-06 - http://www.openwall.com/lists/oss-security/2014/08/16/6 - htt
da00c56220d - https://security.gentoo.org/glsa/201603-06 - http://www.openwall.com/lists/oss-security/2014/08/16/6 - https://www.ffmpeg.org/security.html
CVE ID: CVE-2014-5273 State: PUBLISHED Published: 2014-08-22T01:00:00 Last Updated: 2024-08-06T11:41:47.716Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.2, 4.1.x before 4.1.14.3, and 4.2.x before 4.2.7.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) browse table page, related to js/sql.js; (2) ENUM editor page, related to js/functions.js; (3) monitor page, related to js/server_status_monitor.js; (4) query charts page, related to js/tbl_chart.js; or (5) table relations page, related to libraries/tbl_relation.lib.php. Additional Analyst Notes: - CVE Program
hart.js; or (5) table relations page, related to libraries/tbl_relation.lib.php. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html - https://github.com/phpmyadmin/phpmyadmin/commit/647c9d12e33a6b64e1c3ff7487f72696bdf2dccb - https://github.com/phpmyadmin/phpmyadmin/commit/90ddeecf60fc029608b972e490b735f3a65ed0cb - http://www.phpmyadmin.net/home_page/security/PMASA-2014-8.php - https://github.com/phpmyadmin/phpmyadmin/commit/3ffc967fb60cf2910cc2f571017e977558c67821 - https://github.com/phpmyadmin/phpmyadmin/commit/2c45d7caa614afd71dbe3d0f7270f51ce5569614 - http://secunia.com/advisories/60397 - https://github.com/ph
phpmyadmin/commit/2c45d7caa614afd71dbe3d0f7270f51ce5569614 - http://secunia.com/advisories/60397 - https://github.com/phpmyadmin/phpmyadmin/commit/cd9f302bf7f91a160fe7080f9a612019ef847f1c
CVE ID: CVE-2014-5274 State: PUBLISHED Published: 2014-08-22T01:00:00 Last Updated: 2024-08-06T11:41:47.772Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the view operations page in phpMyAdmin 4.1.x before 4.1.14.3 and 4.2.x before 4.2.7.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted view name, related to js/functions.js. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html - http://www.phpmyadmin.net/home_page/security/PMASA-2014-9.php - https://github.com/phpmyadmin/phpmyadmin/commit/0cd293f5e13aa245e4a57b8d373597cc
t/home_page/security/PMASA-2014-9.php - https://github.com/phpmyadmin/phpmyadmin/commit/0cd293f5e13aa245e4a57b8d373597cc0e421b6f - http://secunia.com/advisories/60397
CVE ID: CVE-2014-5275 State: PUBLISHED Published: 2014-10-20T16:00:00 Last Updated: 2024-08-06T11:41:47.695Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in includes/functions.php in Pro Chat Rooms Text Chat Rooms 8.2.0 allow remote authenticated users to execute arbitrary SQL commands via the (1) password, (2) email, or (3) id parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.osvdb.org/109829 - http://packetstormsecurity.com/files/127775/Pro-Chat-Rooms-8.2.0-XSS-Shell-Upload-SQL-Injection.html - http://archives.neohapsis.com/archives/bugtraq/2014-08/0026.html - http://www.exploit-db.com/exploits/34275
tion.html - http://archives.neohapsis.com/archives/bugtraq/2014-08/0026.html - http://www.exploit-db.com/exploits/34275 - https://exchange.xforce.ibmcloud.com/vulnerabilities/95127
CVE ID: CVE-2014-5276 State: PUBLISHED Published: 2014-10-20T16:00:00 Last Updated: 2024-08-06T11:41:48.276Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Pro Chat Rooms Text Chat Rooms 8.2.0 allow remote authenticated users to inject arbitrary web script or HTML via (1) an uploaded profile picture or (2) the edit parameter to profiles/index.php. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/95125 - https://exchange.xforce.ibmcloud.com/vulnerabilities/95126 - http://packetstormsecurity.com/files/127775/Pro-Chat-Rooms-8.2.0-XSS-Shell-Upload-SQL-Injection.
vulnerabilities/95126 - http://packetstormsecurity.com/files/127775/Pro-Chat-Rooms-8.2.0-XSS-Shell-Upload-SQL-Injection.html - http://archives.neohapsis.com/archives/bugtraq/2014-08/0026.html - http://www.exploit-db.com/exploits/34275