Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2014-5432 State: PUBLISHED Published: 2019-03-26T15:17:16 Last Updated: 2024-08-06T11:41:49.211Z Vendors: Baxter Products: SIGMA Spectrum Infusion System Problem Types: CWE-592 Description: Baxter SIGMA Spectrum Infusion System version 6.05 (model 35700BAX) with wireless battery module (WBM) version 16 is remotely accessible via Port 22/SSH without authentication. A remote attacker may be able to make unauthorized configuration changes to the WBM, as well as issue commands to access account credentials and shared keys. Baxter asserts that this vulnerability only allows access to features and functionality on the WBM and that the SIGMA Spectrum infusion pump cannot be controlled f
allows access to features and functionality on the WBM and that the SIGMA Spectrum infusion pump cannot be controlled from the WBM. Baxter has released a new version of the SIGMA Spectrum Infusion System, Version 8, which incorporates hardware and software changes. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-15-181-01
CVE ID: CVE-2014-5433 State: PUBLISHED Published: 2019-03-26T15:07:39 Last Updated: 2024-08-06T11:41:49.305Z Vendors: Baxter Products: SIGMA Spectrum Infusion System Problem Types: CWE-312 Description: An unauthenticated remote attacker may be able to execute commands to view wireless account credentials that are stored in cleartext on Baxter SIGMA Spectrum Infusion System version 6.05 (model 35700BAX) with wireless battery module (WBM) version 16, which may allow an attacker to gain access the host network. Baxter has released a new version of the SIGMA Spectrum Infusion System, Version 8, which incorporates hardware and software changes. Additional Analyst Notes: - CVE Program Container: R
ystem, Version 8, which incorporates hardware and software changes. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-15-181-01
CVE ID: CVE-2014-5434 State: PUBLISHED Published: 2019-03-26T14:59:52 Last Updated: 2024-08-06T11:41:49.088Z Vendors: Baxter Products: SIGMA Spectrum Infusion System Problem Types: CWE-259 Description: Baxter SIGMA Spectrum Infusion System version 6.05 (model 35700BAX) with wireless battery module (WBM) version 16 has a default account with hard-coded credentials used with the FTP protocol. Baxter asserts no files can be transferred to or from the WBM using this account. Baxter has released a new version of the SIGMA Spectrum Infusion System, Version 8, which incorporates hardware and software changes. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.
ardware and software changes. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-15-181-01
CVE ID: CVE-2014-5435 State: PUBLISHED Published: 2019-04-08T15:25:17 Last Updated: 2024-08-06T11:41:49.065Z Vendors: Honeywell Products: Experion PKS Problem Types: CWE-123 Description: An arbitrary memory write vulnerability exists in the dual_onsrv.exe module in Honeywell Experion PKS R40x before R400.6, R41x before R410.6, and R43x before R430.2, that could lead to possible remote code execution or denial of service. Honeywell strongly encourages and recommends all customers running unsupported versions of EKPS prior to R400 to upgrade to a supported version. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-14-352-01
CVE ID: CVE-2014-5436 State: PUBLISHED Published: 2019-04-08T15:18:41 Last Updated: 2024-08-06T11:41:49.329Z Vendors: Honeywell Products: Experion PKS Problem Types: CWE-22 Description: A directory traversal vulnerability exists in the confd.exe module in Honeywell Experion PKS R40x before R400.6, R41x before R410.6, and R43x before R430.2, which could lead to possible information disclosure. Honeywell strongly encourages and recommends all customers running unsupported versions of EKPS prior to R400 to upgrade to a supported version. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-14-352-01
CVE ID: CVE-2014-5437 State: PUBLISHED Published: 2014-12-17T18:00:00 Last Updated: 2024-08-06T11:41:49.218Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) enable remote management via a request to remote_management.php, (2) add a port forwarding rule via a request to port_forwarding_add.php, (3) change the wireless network to open via a request to wireless_network_configuration_edit.php, or (4) conduct cross-site scripting (XSS) attacks via the ke
n via a request to wireless_network_configuration_edit.php, or (4) conduct cross-site scripting (XSS) attacks via the keyword parameter to managed_sites_add_keyword.php. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2014/Dec/57 - http://seclists.org/fulldisclosure/2014/Dec/58
CVE ID: CVE-2014-5438 State: PUBLISHED Published: 2014-12-17T18:00:00 Last Updated: 2024-08-06T11:41:49.069Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allows remote authenticated users to inject arbitrary web script or HTML via the computer_name parameter to connected_devices_computers_edit.php. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2014/Dec/58
CVE ID: CVE-2014-5439 State: PUBLISHED Published: 2019-11-19T15:05:09 Last Updated: 2024-08-06T11:41:49.299Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple Stack-based Buffer Overflow vulnerabilities exists in Sniffit prior to 0.3.7 via a crafted configuration file that will bypass Non-eXecutable bit NX, stack smashing protector SSP, and address space layout randomization ASLR protection mechanisms, which could let a malicious user execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/129292/Sniffit-Root-Shell.html - http://www.securityfocus.com/bid/71318 - http://seclists.org/fulldisclosure/2014/Nov
es/129292/Sniffit-Root-Shell.html - http://www.securityfocus.com/bid/71318 - http://seclists.org/fulldisclosure/2014/Nov/88
CVE ID: CVE-2014-5440 State: PUBLISHED Published: 2014-09-12T14:00:00 Last Updated: 2024-08-06T11:41:49.124Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Login.aspx in MPEX Business Solutions MX-SmartTimer before 13.19.18 allows remote attackers to execute arbitrary SQL commands via the ct100%24CPHContent%24password parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/95675 - http://seclists.org/fulldisclosure/2014/Aug/83 - http://packetstormsecurity.com/files/128064/MX-SmartTimer-13.18.5.11-SQL-Injection.html
CVE ID: CVE-2014-5441 State: PUBLISHED Published: 2014-09-12T14:00:00 Last Updated: 2024-08-06T11:41:49.310Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in app/views/layouts/application.html.haml in Fat Free CRM before 0.13.3 allow remote attackers to inject arbitrary web script or HTML via the (1) username, (2) first name, or (3) last name in a (a) create or (b) edit user action. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fatfreecrm/fat_free_crm/wiki/XSS-vulnerability-%2826th-August-2014%29 - http://packetstormsecurity.com/files/127978/Fatt-Free-CRM-Cross-Site-Scripting.html - https:/
y-%2826th-August-2014%29 - http://packetstormsecurity.com/files/127978/Fatt-Free-CRM-Cross-Site-Scripting.html - https://github.com/fatfreecrm/fat_free_crm/commit/95464495f1e3e714d5c295fe621af5d2e0d4238d
CVE ID: CVE-2014-5443 State: PUBLISHED Published: 2018-03-19T21:00:00 Last Updated: 2024-08-06T11:41:49.072Z Vendors: n/a Products: n/a Problem Types: n/a Description: Seafile Server before 3.1.2 and Server Professional Edition before 3.1.0 allow local users to gain privileges via vectors related to ccnet handling user accounts. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/95458 - https://manual.seafile.com/changelog/changelog-for-seafile-professional-server.html - https://manual.seafile.com/changelog/server-changelog.html - http://www.openwall.com/lists/oss-security/2014/08/24/3 - http://www.securityfocus.com/bid/69360
CVE ID: CVE-2014-5444 State: PUBLISHED Published: 2014-09-30T14:00:00 Last Updated: 2024-08-06T11:41:49.208Z Vendors: n/a Products: n/a Problem Types: n/a Description: Geary before 0.6.3 does not present the user with a warning when a TLS certificate error is detected, which makes it easier for remote attackers to conduct man-in-the-middle attacks via a crafted certificate. Additional Analyst Notes: - CVE Program Container: References: - https://git.gnome.org/browse/geary/commit/?h=geary-0.6&id=55f06a7bdcedb7efde6a516bde626ea28793ca7e - http://lists.opensuse.org/opensuse-updates/2014-09/msg00035.html - https://bugzilla.gnome.org/show_bug.cgi?id=713247
CVE ID: CVE-2014-5445 State: PUBLISHED Published: 2014-12-04T17:00:00 Last Updated: 2024-08-06T11:41:49.073Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple absolute path traversal vulnerabilities in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allow remote attackers or remote authenticated users to read arbitrary files via a full pathname in the schFilePath parameter to the (1) CSVServlet or (2) CReportPDFServlet servlet. Additional Analyst Notes: - CVE Program Container: References: - https://support.zoho.com/portal/manageengine/helpcenter/articles/cve-2014-5445-cve-2014-5446-fix-for-arbitrary-file-download - https://exchange.xforce.ibmcloud.com/vu
elpcenter/articles/cve-2014-5445-cve-2014-5446-fix-for-arbitrary-file-download - https://exchange.xforce.ibmcloud.com/vulnerabilities/99045 - http://packetstormsecurity.com/files/129336/ManageEngine-Netflow-Analyzer-IT360-File-Download.html - http://www.securityfocus.com/archive/1/534141/100/0/threaded - http://www.securityfocus.com/bid/71404 - https://github.com/rapid7/metasploit-framework/pull/4282 - https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_netflow_it360_file_dl.txt - http://www.securityfocus.com/archive/1/534122/100/0/threaded - http://seclists.org/fulldisclosure/2014/Dec/9
CVE ID: CVE-2014-5446 State: PUBLISHED Published: 2014-12-04T17:00:00 Last Updated: 2024-08-06T11:41:49.185Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the DisplayChartPDF servlet in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allows remote attackers and remote authenticated users to read arbitrary files via a .. (dot dot) in the filename parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/99046 - https://support.zoho.com/portal/manageengine/helpcenter/articles/cve-2014-5445-cve-2014-5446-fix-for-arbitrary-file-download - http://packetstorms
ortal/manageengine/helpcenter/articles/cve-2014-5445-cve-2014-5446-fix-for-arbitrary-file-download - http://packetstormsecurity.com/files/129336/ManageEngine-Netflow-Analyzer-IT360-File-Download.html - http://www.securityfocus.com/archive/1/534141/100/0/threaded - http://www.securityfocus.com/bid/71404 - https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_netflow_it360_file_dl.txt - http://www.securityfocus.com/archive/1/534122/100/0/threaded - http://seclists.org/fulldisclosure/2014/Dec/9
CVE ID: CVE-2014-5447 State: PUBLISHED Published: 2014-10-20T15:00:00 Last Updated: 2024-08-06T11:48:48.404Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zarafa WebAccess 7.1.10 and WebApp 1.6 beta uses weak permissions (644) for config.php, which allows local users to obtain sensitive information by reading the PHP session files. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0103. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/oss-sec/2014/q3/444 - http://www.securityfocus.com/bid/69362 - http://advisories.mageia.org/MGASA-2014-0380.html - http://www.mandriva.com/security/advisories?name=MDVSA-2014:182 - http://
//advisories.mageia.org/MGASA-2014-0380.html - http://www.mandriva.com/security/advisories?name=MDVSA-2014:182 - http://seclists.org/oss-sec/2014/q3/445
CVE ID: CVE-2014-5448 State: PUBLISHED Published: 2014-10-20T15:00:00 Last Updated: 2024-08-06T11:48:48.458Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zarafa 5.00 uses world-readable permissions for the files in the log directory, which allows local users to obtain sensitive information by reading the log files. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/69365 - http://seclists.org/oss-sec/2014/q3/444 - http://advisories.mageia.org/MGASA-2014-0380.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/95452 - http://www.mandriva.com/security/advisories?name=MDVSA-2014:182 - http://seclists.org/oss-sec/2014/q3/445
CVE ID: CVE-2014-5449 State: PUBLISHED Published: 2014-10-20T15:00:00 Last Updated: 2024-08-06T11:48:48.455Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zarafa WebAccess 4.1 and WebApp uses world-readable permissions for the files in their tmp directory, which allows local users to obtain sensitive information by reading temporary session data. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/oss-sec/2014/q3/444 - https://exchange.xforce.ibmcloud.com/vulnerabilities/95453 - http://advisories.mageia.org/MGASA-2014-0380.html - http://www.securityfocus.com/bid/69369 - http://www.mandriva.com/security/advisories?name=MDVSA-2014:182 - http://secl
- http://www.securityfocus.com/bid/69369 - http://www.mandriva.com/security/advisories?name=MDVSA-2014:182 - http://seclists.org/oss-sec/2014/q3/445
CVE ID: CVE-2014-5450 State: PUBLISHED Published: 2018-03-19T21:00:00 Last Updated: 2024-08-06T11:48:48.460Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zarafa Collaboration Platform 4.1 uses world-readable permissions for /etc/zarafa/license, which allows local users to obtain sensitive information by reading license files. Additional Analyst Notes: - CVE Program Container: References: - http://lists.fedoraproject.org/pipermail/package-announce/2014-August/137158.html - https://bugzilla.redhat.com/show_bug.cgi?id=1133439 - http://lists.fedoraproject.org/pipermail/package-announce/2014-September/137232.html - http://www.openwall.com/lists/oss-security/2014/08/25/1 - http://www
rmail/package-announce/2014-September/137232.html - http://www.openwall.com/lists/oss-security/2014/08/25/1 - http://www.securityfocus.com/bid/69370 - https://exchange.xforce.ibmcloud.com/vulnerabilities/95454
CVE ID: CVE-2014-5451 State: PUBLISHED Published: 2014-11-06T18:00:00 Last Updated: 2024-08-06T11:48:48.442Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in manager/templates/default/header.tpl in MODX Revolution 2.3.1-pl and earlier allows remote attackers to inject arbitrary web script or HTML via the "a" parameter to manager/. NOTE: this issue exists because of a CVE-2014-2080 regression. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/128302/MODX-Revolution-2.3.1-pl-Cross-Site-Scripting.html - http://www.securityfocus.com/archive/1/533466/100/0/threaded - https://github.com/modxcm
-pl-Cross-Site-Scripting.html - http://www.securityfocus.com/archive/1/533466/100/0/threaded - https://github.com/modxcms/revolution/commit/e36f80f18e9514204bf2ce82747c8adf7e47a9c9 - https://www.htbridge.com/advisory/HTB23229 - http://www.securityfocus.com/bid/69884
CVE ID: CVE-2014-5452 State: PUBLISHED Published: 2014-09-02T10:00:00 Last Updated: 2024-08-06T11:48:48.475Z Vendors: n/a Products: n/a Problem Types: n/a Description: CDA.xsl in HL7 C-CDA 1.1 and earlier does not anticipate the possibility of invalid C-CDA documents with crafted XML attributes, which allows remote attackers to conduct XSS attacks via a document containing a table that is improperly handled during unrestricted xsl:copy operations. Additional Analyst Notes: - CVE Program Container: References: - http://motorcycleguy.blogspot.com/2014/04/hl7-cda-stylesheet-patches.html - http://www.securityfocus.com/bid/69633 - http://gforge.hl7.org/gf/project/strucdoc/frs/?action=FrsReleaseVi
tches.html - http://www.securityfocus.com/bid/69633 - http://gforge.hl7.org/gf/project/strucdoc/frs/?action=FrsReleaseView&release_id=1088 - http://smartplatforms.org/2014/04/security-vulnerabilities-in-ccda-display/ - http://www.securitytracker.com/id/1033511 - http://www-01.ibm.com/support/docview.wss?uid=swg21699588
CVE ID: CVE-2014-5453 State: PUBLISHED Published: 2014-08-25T16:00:00Z Last Updated: 2024-09-17T00:50:41.673Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ubisoft Uplay PC before 4.6.1.3217 use weak permissions (Everyone: Full Control) for the program installation directory (%PROGRAMFILES%\Ubisoft Game Launcher), which allows local users to gain privileges via a Trojan horse file. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/show/osvdb/108726 - http://www.exploit-db.com/exploits/33961 - http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5191.php
CVE ID: CVE-2014-5454 State: PUBLISHED Published: 2014-08-25T16:00:00 Last Updated: 2024-08-06T11:48:48.481Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted file upload vulnerability in the image upload module in SAS Visual Analytics 6.4M1 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/95351 - http://packetstormsecurity.com/files/127866/SAS-Visual-Analytics-6.4M1-Arbitrary-File-Upload.html
CVE ID: CVE-2014-5455 State: PUBLISHED Published: 2014-08-25T16:00:00 Last Updated: 2024-08-06T11:48:49.221Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unquoted Windows search path vulnerability in the ptservice service prior to PrivateTunnel version 3.0 (Windows) and OpenVPN Connect version 3.1 (Windows) allows local users to gain privileges via a crafted program.exe file in the %SYSTEMDRIVE% folder. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/34037 - http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5192.php - http://packetstormsecurity.com/files/127439/OpenVPN-Private-Tunnel-Privilege-Escalation.html - https://h20
14-5192.php - http://packetstormsecurity.com/files/127439/OpenVPN-Private-Tunnel-Privilege-Escalation.html - https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05325943 - http://osvdb.org/show/osvdb/109007 - https://github.com/CVEProject/cvelist/pull/3909/commits/ace34f1cf94602f31760d3eb7ae68e17df8f914d - https://github.com/CVEProject/cvelist/pull/3909
CVE ID: CVE-2014-5456 State: PUBLISHED Published: 2014-08-25T16:00:00 Last Updated: 2024-08-06T11:48:49.498Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Social Stats module before 7.x-1.5 for Drupal allows remote authenticated users with the "[Content Type]: Create new content" permission to inject arbitrary web script or HTML via vectors related to the configuration. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/69346 - https://www.drupal.org/node/2323983 - http://secunia.com/advisories/60759 - https://www.drupal.org/node/2324681
CVE ID: CVE-2014-5457 State: PUBLISHED Published: 2014-08-25T16:00:00Z Last Updated: 2024-09-17T02:26:58.853Z Vendors: n/a Products: n/a Problem Types: n/a Description: QNAP TS-469U with firmware 4.0.7 Build 20140410, TS-459U, TS-EC1679U-RP, and SS-839 use world-readable permissions for /etc/config/shadow, which allows local users to obtain usernames and hashed passwords by reading the password. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2014/Jul/57 - http://seclists.org/fulldisclosure/2014/Jul/58 - http://seclists.org/fulldisclosure/2014/Jul/61 - http://seclists.org/fulldisclosure/2014/Jul/59
CVE ID: CVE-2014-5458 State: PUBLISHED Published: 2014-08-25T16:00:00 Last Updated: 2024-08-06T11:48:48.492Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in sqrl_verify.php in php-sqrl allows remote attackers to execute arbitrary SQL commands via the message parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/69270 - http://seclists.org/fulldisclosure/2014/Aug/49 - https://github.com/geir54/php-sqrl/issues/4 - https://github.com/geir54/php-sqrl/blob/0fa574520a1843a33a84c3985f934e84af6f2042/sqrl_verify.php#L39-59
CVE ID: CVE-2014-5459 State: PUBLISHED Published: 2014-09-27T10:00:00 Last Updated: 2024-08-06T11:48:49.572Z Vendors: n/a Products: n/a Problem Types: n/a Description: The PEAR_REST class in REST.php in PEAR in PHP through 5.6.0 allows local users to write to arbitrary files via a symlink attack on a (1) rest.cachefile or (2) rest.cacheid file in /tmp/pear/cache/, related to the retrieveCacheFirst and useLocalCache functions. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=759282 - http://lists.opensuse.org/opensuse-updates/2014-09/msg00055.html - http://www.openwall.com/lists/oss-security/2014/08/27/3 - http://www.oracle.com
opensuse-updates/2014-09/msg00055.html - http://www.openwall.com/lists/oss-security/2014/08/27/3 - http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html - http://lists.opensuse.org/opensuse-updates/2014-09/msg00024.html
CVE ID: CVE-2014-5460 State: PUBLISHED Published: 2014-09-11T15:00:00 Last Updated: 2024-08-06T11:48:48.473Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted file upload vulnerability in the Tribulant Slideshow Gallery plugin before 1.4.7 for WordPress allows remote authenticated users to execute arbitrary code by uploading a PHP file, then accessing it via a direct request to the file in wp-content/uploads/slideshow-gallery/. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/34681 - http://packetstormsecurity.com/files/128069/WordPress-Slideshow-Gallery-1.4.6-Shell-Upload.html - http://whitexploit.blogspot.mx/2014/08/w
security.com/files/128069/WordPress-Slideshow-Gallery-1.4.6-Shell-Upload.html - http://whitexploit.blogspot.mx/2014/08/wordpress-slideshow-gallery-146-shell.html - http://www.securityfocus.com/archive/1/533281/100/0/threaded - http://secunia.com/advisories/60074 - http://www.exploit-db.com/exploits/34514 - https://wordpress.org/plugins/slideshow-gallery/changelog - https://exchange.xforce.ibmcloud.com/vulnerabilities/95676
CVE ID: CVE-2014-5461 State: PUBLISHED Published: 2014-09-04T00:00:00 Last Updated: 2024-08-06T11:48:49.016Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows context-dependent attackers to cause a denial of service (crash) via a small number of arguments to a function with a large number of fixed arguments. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2014/08/21/4 - http://www.ubuntu.com/usn/USN-2338-1 - https://security.gentoo.org/glsa/201701-53 - http://www.openwall.com/lists/oss-security/2014/08/27/2 - http://www.securityfoc