Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2014-3914 State: PUBLISHED Published: 2014-08-07T10:00:00 Last Updated: 2024-08-06T10:57:18.048Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the Admin Center for Tivoli Storage Manager (TSM) in Rocket ServerGraph 1.2 allows remote attackers to (1) create arbitrary files via a .. (dot dot) in the query parameter in a writeDataFile action to the fileRequestor servlet, execute arbitrary files via a .. (dot dot) in the query parameter in a (2) run or (3) runClear action to the fileRequestor servlet, (4) read arbitrary files via a readDataFile action to the fileRequestor servlet, (5) execute arbitrary code via a save_server_groups ac
ary files via a readDataFile action to the fileRequestor servlet, (5) execute arbitrary code via a save_server_groups action to the userRequest servlet, or (6) delete arbitrary files via a del action in the fileRequestServlet servlet. Additional Analyst Notes: - CVE Program Container: References: - http://zerodayinitiative.com/advisories/ZDI-14-166/ - http://www.exploit-db.com/exploits/33807 - http://zerodayinitiative.com/advisories/ZDI-14-165/ - http://zerodayinitiative.com/advisories/ZDI-14-163/ - http://zerodayinitiative.com/advisories/ZDI-14-161/ - http://zerodayinitiative.com/advisories/ZDI-14-162/
CVE ID: CVE-2014-3915 State: PUBLISHED Published: 2014-06-11T14:00:00 Last Updated: 2024-08-06T10:57:17.959Z Vendors: n/a Products: n/a Problem Types: n/a Description: The userRequest servlet in the Admin Center for Tivoli Storage Manager in Rocket Servergraph allows remote attackers to execute arbitrary commands via a (1) auth, (2) auth_session, (3) auth_simple, (4) add, (5) add_flat, (6) remove, (7) set_pwd, (8) add_permissions, (9) revoke_permissions, (10) runAsync, or (11) tsmRequest command. Additional Analyst Notes: - CVE Program Container: References: - http://www.zerodayinitiative.com/advisories/ZDI-14-164/ - http://www.securityfocus.com/bid/67780
CVE ID: CVE-2014-3916 State: PUBLISHED Published: 2014-11-16T17:00:00 Last Updated: 2024-08-06T10:57:17.953Z Vendors: n/a Products: n/a Problem Types: n/a Description: The str_buf_cat function in string.c in Ruby 1.9.3, 2.0.0, and 2.1 allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a long string. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/93505 - http://www.securityfocus.com/bid/67705 - https://bugs.ruby-lang.org/issues/9709 - http://seclists.org/oss-sec/2014/q2/375 - http://seclists.org/oss-sec/2014/q2/362
CVE ID: CVE-2014-3917 State: PUBLISHED Published: 2014-06-05T17:00:00 Last Updated: 2024-08-06T10:57:18.066Z Vendors: n/a Products: n/a Problem Types: n/a Description: kernel/auditsc.c in the Linux kernel through 3.14.5, when CONFIG_AUDITSYSCALL is enabled with certain syscall rules, allows local users to obtain potentially sensitive single-bit values from kernel memory or cause a denial of service (OOPS) via a large value of a syscall number. Additional Analyst Notes: - CVE Program Container: References: - http://article.gmane.org/gmane.linux.kernel/1713179 - http://www.ubuntu.com/usn/USN-2335-1 - http://www.ubuntu.com/usn/USN-2334-1 - http://secunia.com/advisories/60564 - http://secunia.co
untu.com/usn/USN-2335-1 - http://www.ubuntu.com/usn/USN-2334-1 - http://secunia.com/advisories/60564 - http://secunia.com/advisories/59777 - http://rhn.redhat.com/errata/RHSA-2014-1143.html - http://secunia.com/advisories/60011 - http://www.openwall.com/lists/oss-security/2014/05/29/5 - https://bugzilla.redhat.com/show_bug.cgi?id=1102571 - http://rhn.redhat.com/errata/RHSA-2014-1281.html - http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html
CVE ID: CVE-2014-3918 State: REJECTED Published: 2022-07-07T16:03:18 Last Updated: 2022-07-07T16:03:18 Description: No description available.
CVE ID: CVE-2014-3919 State: PUBLISHED Published: 2020-02-13T19:00:01 Last Updated: 2024-08-06T10:57:17.938Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability exists in Netgear CG3100 devices before 3.9.2421.13.mp3 V0027 via an embed malicious script in an unspecified page, which could let a malicious user obtain sensitive information. Additional Analyst Notes: - CVE Program Container: References: - http://softage.be/netgear/
CVE ID: CVE-2014-3920 State: PUBLISHED Published: 2014-07-03T14:00:00 Last Updated: 2024-08-06T10:57:18.055Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in Kanboard before 1.0.6 allows remote attackers to hijack the authentication of administrators for requests that add an administrative user via a save action to the default URI. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/532619/100/0/threaded - http://kanboard.net/news - https://www.htbridge.com/advisory/HTB23217
CVE ID: CVE-2014-3921 State: PUBLISHED Published: 2014-05-30T14:00:00Z Last Updated: 2024-09-16T22:02:39.213Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in popup.php in the Simple Popup Images plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the z parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/126763/WordPress-Simple-Popup-Cross-Site-Scripting.html - http://www.securityfocus.com/bid/67562
CVE ID: CVE-2014-3922 State: PUBLISHED Published: 2014-05-30T14:00:00 Last Updated: 2024-08-06T10:57:17.925Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Trend Micro InterScan Messaging Security Virtual Appliance 8.5.1.1516 allows remote authenticated users to inject arbitrary web script or HTML via the addWhiteListDomainStr parameter to addWhiteListDomain.imss. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1030318 - http://secunia.com/advisories/58491 - http://packetstormsecurity.com/files/126847/InterScan-Messaging-Security-Virtual-Appliance-8.5.1.1516-Cross-Site-Scripting.html -
ketstormsecurity.com/files/126847/InterScan-Messaging-Security-Virtual-Appliance-8.5.1.1516-Cross-Site-Scripting.html - http://seclists.org/fulldisclosure/2014/May/164 - http://www.securityfocus.com/bid/67726 - https://vimeo.com/96757096
CVE ID: CVE-2014-3923 State: PUBLISHED Published: 2014-05-30T14:00:00Z Last Updated: 2024-09-17T00:31:05.144Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the Digital Zoom Studio (DZS) Video Gallery plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the logoLink parameter to (1) preview.swf, (2) preview_skin_rouge.swf, (3) preview_allchars.swf, or (4) preview_skin_overlay.swf in deploy/. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2014/May/157 - http://websecurity.com.ua/7183
CVE ID: CVE-2014-3924 State: PUBLISHED Published: 2014-05-30T14:00:00 Last Updated: 2024-08-06T10:57:18.053Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Webmin before 1.690 and Usermin before 1.600 allow remote attackers to inject arbitrary web script or HTML via vectors related to popup windows. Additional Analyst Notes: - CVE Program Container: References: - http://www.webmin.com/changes.html - http://secunia.com/advisories/58917 - http://secunia.com/advisories/58919 - http://www.securityfocus.com/bid/67649 - http://www.webmin.com/uchanges.html - http://www.securitytracker.com/id/1030296 - http://www.securitytracker.com/
7649 - http://www.webmin.com/uchanges.html - http://www.securitytracker.com/id/1030296 - http://www.securitytracker.com/id/1030297 - http://www.securityfocus.com/bid/67647
CVE ID: CVE-2014-3925 State: PUBLISHED Published: 2014-06-01T01:00:00 Last Updated: 2024-08-06T10:57:18.124Z Vendors: n/a Products: n/a Problem Types: n/a Description: sosreport in Red Hat sos 1.7 and earlier on Red Hat Enterprise Linux (RHEL) 5 produces an archive with an fstab file potentially containing cleartext passwords, and lacks a warning about reviewing this archive to detect included passwords, which might allow remote attackers to obtain sensitive information by leveraging access to a technical-support data stream. Additional Analyst Notes: - CVE Program Container: References: - http://openwall.com/lists/oss-security/2014/05/29/6 - http://www.ubuntu.com/usn/USN-2845-1 - https://bu
r: References: - http://openwall.com/lists/oss-security/2014/05/29/6 - http://www.ubuntu.com/usn/USN-2845-1 - https://bugzilla.redhat.com/show_bug.cgi?id=1102633 - http://openwall.com/lists/oss-security/2014/05/30/3
CVE ID: CVE-2014-3926 State: PUBLISHED Published: 2017-03-13T16:00:00 Last Updated: 2024-08-06T10:57:17.954Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in lg.cgi in Cougar LG 1.9 allows remote attackers to inject arbitrary web script or HTML via the "addr" parameter. Additional Analyst Notes: - CVE Program Container: References: - https://tools.cisco.com/security/center/viewAlert.x?alertId=35685 - http://blog.talosintelligence.com/2014/09/looking-glasses-with-bacon.html - https://gist.github.com/bittorrent3389/8fee7cdaa73d1d351ee9 - https://github.com/Cougar/lg/issues/3 - https://hackerone.com/reports/16330
CVE ID: CVE-2014-3927 State: PUBLISHED Published: 2017-04-03T15:00:00 Last Updated: 2024-08-06T10:57:18.085Z Vendors: n/a Products: n/a Problem Types: n/a Description: mrlg-lib.php in mrlg4php before 1.0.8 allows remote attackers to execute arbitrary shell code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/infrastation/mrlg4php/issues/1 - http://www.s3.eurecom.fr/cve/CVE-2014-3927.txt - https://hackerone.com/reports/16330
CVE ID: CVE-2014-3928 State: PUBLISHED Published: 2017-04-03T15:00:00 Last Updated: 2024-08-06T10:57:18.023Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cougar-LG stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain credentials. Additional Analyst Notes: - CVE Program Container: References: - http://www.s3.eurecom.fr/cve/CVE-2014-3928.txt - https://github.com/Cougar/lg/issues/4 - https://hackerone.com/reports/16330
CVE ID: CVE-2014-3929 State: PUBLISHED Published: 2017-04-03T15:00:00 Last Updated: 2024-08-06T10:57:18.068Z Vendors: n/a Products: n/a Problem Types: n/a Description: The default configuration for Cougar-LG stores sensitive information under the web root with insufficient access control, which might allow remote attackers to obtain private ssh keys. Additional Analyst Notes: - CVE Program Container: References: - http://www.s3.eurecom.fr/cve/CVE-2014-3929.txt - https://github.com/Cougar/lg/issues/5 - https://hackerone.com/reports/16330
CVE ID: CVE-2014-3930 State: PUBLISHED Published: 2017-04-03T15:00:00 Last Updated: 2024-08-06T10:57:17.917Z Vendors: n/a Products: n/a Problem Types: n/a Description: lg.pl in Cistron-LG 1.01 stores sensitive information under the web root with insufficient access controls, which allows remote attackers to obtain IP addresses and other unspecified router credentials. Additional Analyst Notes: - CVE Program Container: References: - http://www.s3.eurecom.fr/cve/CVE-2014-3930.txt - https://hackerone.com/reports/16330
CVE ID: CVE-2014-3931 State: PUBLISHED Published: 2017-03-31T15:00:00.000Z Last Updated: 2025-10-21T23:55:43.153Z Vendors: n/a Products: n/a Problem Types: n/a Description: fastping.c in MRLG (aka Multi-Router Looking Glass) before 5.5.0 allows remote attackers to cause an arbitrary memory write and memory corruption. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://mrlg.op-sec.us/ - http://www.s3.eurecom.fr/cve/CVE-2014-3931.txt - https://hackerone.com/reports/16330
CVE ID: CVE-2014-3932 State: PUBLISHED Published: 2014-06-02T14:00:00Z Last Updated: 2024-09-16T22:02:23.040Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the device registration component in wsf/webservice.php in CoSoSys Endpoint Protector 4 4.3.0.4 and 4.4.0.2 allows remote attackers to execute arbitrary SQL commands via unspecified parameters. Additional Analyst Notes: - CVE Program Container: References: - https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140521-CoSoSys_Endpoint_Protector_Multiple_Vulnerabilities_v10_wo_poc.txt - http://secunia.com/advisories/58878
CVE ID: CVE-2014-3933 State: PUBLISHED Published: 2014-06-02T14:00:00 Last Updated: 2024-08-06T10:57:18.054Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the address components field formatter in the AddressField Tokens module 7.x-1.x before 7.x-1.4 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via an address field. Additional Analyst Notes: - CVE Program Container: References: - https://drupal.org/node/2267475 - http://www.securityfocus.com/bid/67545 - https://drupal.org/node/2267485 - http://secunia.com/advisories/58399
CVE ID: CVE-2014-3934 State: PUBLISHED Published: 2014-06-02T14:00:00Z Last Updated: 2024-09-17T03:28:04.900Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the Submit_News module for PHP-Nuke 8.3 allows remote attackers to execute arbitrary SQL commands via the topics[] parameter to modules.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/126803/phpnuke83news-sql.txt - http://www.securityfocus.com/bid/67656
CVE ID: CVE-2014-3935 State: PUBLISHED Published: 2014-06-02T14:00:00Z Last Updated: 2024-09-16T23:55:37.372Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in glossaire-aff.php in the Glossaire module 1.0 for XOOPS allows remote attackers to execute arbitrary SQL commands via the lettre parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/67460 - http://packetstormsecurity.com/files/126701
CVE ID: CVE-2014-3936 State: PUBLISHED Published: 2014-06-02T14:00:00 Last Updated: 2024-08-06T10:57:17.947Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in the do_hnap function in www/my_cgi.cgi in D-Link DSP-W215 (Rev. A1) with firmware 1.01b06 and earlier, DIR-505 with firmware before 1.08b10, and DIR-505L with firmware 1.01 and earlier allows remote attackers to execute arbitrary code via a long Content-Length header in a GetDeviceSettings action in an HNAP request. Additional Analyst Notes: - CVE Program Container: References: - http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10027 - http://www.devttys0.com/2014/05/hacking-
- http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10027 - http://www.devttys0.com/2014/05/hacking-the-d-link-dsp-w215-smart-plug - http://secunia.com/advisories/58728 - http://packetstormsecurity.com/files/127427/D-Link-HNAP-Request-Remote-Buffer-Overflow.html - http://secunia.com/advisories/58972 - http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10029 - http://www.securityfocus.com/bid/67651
CVE ID: CVE-2014-3937 State: PUBLISHED Published: 2014-06-02T15:00:00Z Last Updated: 2024-09-17T00:51:42.599Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the Contextual Related Posts plugin before 1.8.10.2 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://wordpress.org/plugins/contextual-related-posts/changelog/
CVE ID: CVE-2014-3938 State: PUBLISHED Published: 2014-07-23T14:00:00 Last Updated: 2024-08-06T10:57:17.936Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow in Autodesk SketchBook Pro before 6.2.6 allows remote attackers to execute arbitrary code via crafted layer mask data in a PSD file, which triggers a heap-based buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/secunia_research/2014-6/ - http://secunia.com/advisories/58000
CVE ID: CVE-2014-3939 State: PUBLISHED Published: 2014-07-23T14:00:00 Last Updated: 2024-08-06T10:57:18.061Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in Autodesk SketchBook Pro before 6.2.6 allows remote attackers to execute arbitrary code via crafted layer bitmap data in a PXD file. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/secunia_research/2014-7/ - http://secunia.com/advisories/58000
CVE ID: CVE-2014-3940 State: PUBLISHED Published: 2014-06-05T17:00:00 Last Updated: 2024-08-06T10:57:18.119Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Linux kernel through 3.14.5 does not properly consider the presence of hugetlb entries, which allows local users to cause a denial of service (memory corruption or system crash) by accessing certain memory locations, as demonstrated by triggering a race condition via numa_maps read operations during hugepage migration, related to fs/proc/task_mmu.c and mm/mempolicy.c. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1104097 - http://secunia.com/advisories/59011 -
am Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1104097 - http://secunia.com/advisories/59011 - https://lkml.org/lkml/2014/3/18/784 - https://support.f5.com/kb/en-us/solutions/public/15000/600/sol15685.html - http://rhn.redhat.com/errata/RHSA-2015-0290.html - http://www.openwall.com/lists/oss-security/2014/06/02/5 - http://www.securityfocus.com/bid/67786 - http://secunia.com/advisories/61310 - http://rhn.redhat.com/errata/RHSA-2015-1272.html
CVE ID: CVE-2014-3941 State: PUBLISHED Published: 2014-06-03T14:00:00 Last Updated: 2024-08-06T10:57:18.080Z Vendors: n/a Products: n/a Problem Types: n/a Description: TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, 6.1.0 before 6.1.9, and 6.2.0 before 6.2.3 allows remote attackers to have unspecified impact via a crafted HTTP Host header, related to "Host Spoofing." Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00028.html - http://lists.opensuse.org/opensuse-updates/2014-06/msg00037.html - http://www.debian.org/security/2014/dsa-2942 - http://lists.opensuse.org/opensuse-updates/2016-08/ms
-06/msg00037.html - http://www.debian.org/security/2014/dsa-2942 - http://lists.opensuse.org/opensuse-updates/2016-08/msg00083.html - http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001/ - http://www.openwall.com/lists/oss-security/2014/06/03/2
CVE ID: CVE-2014-3942 State: PUBLISHED Published: 2014-06-03T14:00:00 Last Updated: 2024-08-06T10:57:17.967Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Color Picker Wizard component in TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, and 6.1.0 before 6.1.9 allows remote authenticated editors to execute arbitrary PHP code via a serialized PHP object. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-updates/2014-06/msg00037.html - http://www.debian.org/security/2014/dsa-2942 - http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001/ - http://www.openwall.com/lists/oss-securit
po3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001/ - http://www.openwall.com/lists/oss-security/2014/06/03/2
CVE ID: CVE-2014-3943 State: PUBLISHED Published: 2014-06-03T14:00:00 Last Updated: 2024-08-06T10:57:17.932Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in unspecified backend components in TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, 6.1.0 before 6.1.9, and 6.2.0 before 6.2.3 allow remote authenticated editors to inject arbitrary web script or HTML via unknown parameters. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-updates/2014-06/msg00037.html - http://www.debian.org/security/2014/dsa-2942 - http://typo3.org/teams/security/security-bulletins/typ
06/msg00037.html - http://www.debian.org/security/2014/dsa-2942 - http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001/ - http://www.openwall.com/lists/oss-security/2014/06/03/2 - http://www.securityfocus.com/bid/67625
CVE ID: CVE-2014-3944 State: PUBLISHED Published: 2014-06-03T14:00:00 Last Updated: 2024-08-06T10:57:17.950Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Authentication component in TYPO3 6.2.0 before 6.2.3 does not properly invalidate timed out user sessions, which allows remote attackers to bypass authentication via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2014/dsa-2942 - http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001/ - http://www.openwall.com/lists/oss-security/2014/06/03/2
CVE ID: CVE-2014-3945 State: PUBLISHED Published: 2014-06-03T14:00:00 Last Updated: 2024-08-06T10:57:17.942Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Authentication component in TYPO3 before 6.2, when salting for password hashing is disabled, does not require knowledge of the cleartext password if the password hash is known, which allows remote attackers to bypass authentication and gain access to the backend by leveraging knowledge of a password hash. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2014/dsa-2942 - http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001/ - http://www.openwall.c
dsa-2942 - http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001/ - http://www.openwall.com/lists/oss-security/2014/06/03/2
CVE ID: CVE-2014-3946 State: PUBLISHED Published: 2014-06-03T14:00:00 Last Updated: 2024-08-06T10:57:17.950Z Vendors: n/a Products: n/a Problem Types: n/a Description: The query caching functionality in the Extbase Framework component in TYPO3 6.2.0 before 6.2.3 does not properly validate group permissions, which allows remote authenticated users to read arbitrary queries via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2014/dsa-2942 - http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001/ - http://www.openwall.com/lists/oss-security/2014/06/03/2
CVE ID: CVE-2014-3947 State: PUBLISHED Published: 2014-10-03T14:00:00 Last Updated: 2024-08-06T10:57:18.097Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted file upload vulnerability in the powermail extension before 1.6.11 and 2.x before 2.0.14 for TYPO3 allows remote attackers to execute arbitrary code by uploading a file with a crafted extension, then accessing it via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-007/ - http://typo3.org/extensions/repository/view/powermail
CVE ID: CVE-2014-3948 State: PUBLISHED Published: 2014-06-04T14:00:00 Last Updated: 2024-08-06T10:57:17.944Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the HTML export wizard in the backend module in the powermail extension before 1.6.11 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://typo3.org/extensions/repository/view/powermail - http://secunia.com/advisories/58909 - http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-007 - http://www.openwall.com/lists/oss-security/2014/06/03