Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2014-2891 State: PUBLISHED Published: 2014-05-07T10:00:00 Last Updated: 2024-08-06T10:28:46.215Z Vendors: n/a Products: n/a Problem Types: n/a Description: strongSwan before 5.1.2 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon crash) via a crafted ID_DER_ASN1_DN ID payload. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/59864 - http://www.debian.org/security/2014/dsa-2922 - http://www.securityfocus.com/bid/67212 - http://lists.opensuse.org/opensuse-updates/2014-05/msg00064.html - http://lists.opensuse.org/opensuse-updates/2014-05/msg00066.html - http://www.strongswan.org/blog/2014/05/05
0064.html - http://lists.opensuse.org/opensuse-updates/2014-05/msg00066.html - http://www.strongswan.org/blog/2014/05/05/strongswan-denial-of-service-vulnerability-%28cve-2014-2891%29.html
CVE ID: CVE-2014-2892 State: PUBLISHED Published: 2014-04-22T14:00:00 Last Updated: 2024-08-06T10:28:46.038Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in the get_answer function in mmsh.c in libmms before 0.6.4 allows remote attackers to execute arbitrary code via a long line in an MMS over HTTP (MMSH) server response. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2014/dsa-2916 - http://www.securityfocus.com/bid/66933 - http://secunia.com/advisories/57875 - http://sourceforge.net/p/libmms/code/ci/master/tree/ChangeLog - http://lists.opensuse.org/opensuse-updates/2014-05/msg00001.html - http://www.op
/libmms/code/ci/master/tree/ChangeLog - http://lists.opensuse.org/opensuse-updates/2014-05/msg00001.html - http://www.openwall.com/lists/oss-security/2014/04/18/14 - https://security.gentoo.org/glsa/201612-29 - http://sourceforge.net/p/libmms/code/ci/03bcfccc22919c72742b7338d02859962861e0e8 - https://exchange.xforce.ibmcloud.com/vulnerabilities/92640
CVE ID: CVE-2014-2893 State: PUBLISHED Published: 2014-04-23T14:00:00 Last Updated: 2024-08-06T10:28:46.175Z Vendors: n/a Products: n/a Problem Types: n/a Description: The GetHTMLRunDir function in the scan-build utility in Clang 3.5 and earlier allows local users to obtain sensitive information or overwrite arbitrary files via a symlink attack on temporary directories with predictable names. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2014/04/16/2 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=744817 - http://lists.opensuse.org/opensuse-updates/2015-02/msg00038.html - http://www.openwall.com/lists/oss-security/2014/04/20/1
CVE ID: CVE-2014-2894 State: PUBLISHED Published: 2014-04-23T14:00:00 Last Updated: 2024-08-06T10:28:46.186Z Vendors: n/a Products: n/a Problem Types: n/a Description: Off-by-one error in the cmd_smart function in the smart self test in hw/ide/core.c in QEMU before 2.0 allows local users to have unspecified impact via a SMART EXECUTE OFFLINE command that triggers a buffer underflow and memory corruption. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2014-0743.html - https://lists.nongnu.org/archive/html/qemu-devel/2014-04/msg02016.html - http://rhn.redhat.com/errata/RHSA-2014-0744.html - https://lists.nongnu.org/archive/html/qemu-devel/201
/msg02016.html - http://rhn.redhat.com/errata/RHSA-2014-0744.html - https://lists.nongnu.org/archive/html/qemu-devel/2014-04/msg02095.html - http://www.ubuntu.com/usn/USN-2182-1 - https://lists.nongnu.org/archive/html/qemu-devel/2014-04/msg02152.html - http://secunia.com/advisories/57945 - http://www.openwall.com/lists/oss-security/2014/04/18/5 - http://rhn.redhat.com/errata/RHSA-2014-0704.html - http://www.openwall.com/lists/oss-security/2014/04/15/4 - http://www.securityfocus.com/bid/66932 - http://secunia.com/advisories/58191
CVE ID: CVE-2014-2895 State: REJECTED Published: 2022-07-07T15:59:25 Last Updated: 2022-07-07T15:59:25 Description: No description available.
CVE ID: CVE-2014-2896 State: PUBLISHED Published: 2020-01-28T15:41:55 Last Updated: 2024-08-06T10:28:46.245Z Vendors: n/a Products: n/a Problem Types: n/a Description: The DoAlert function in the (1) TLS and (2) DTLS implementations in wolfSSL CyaSSL before 2.9.4 allows remote attackers to have unspecified impact and vectors, which trigger memory corruption or an out-of-bounds read. Additional Analyst Notes: - CVE Program Container: References: - http://www.wolfssl.com/yaSSL/Blog/Entries/2014/4/11_wolfSSL_Security_Advisory__April_9%2C_2014.html - http://www.wolfssl.com/yaSSL/Docs-cyassl-changelog.html - http://seclists.org/oss-sec/2014/q2/126 - http://seclists.org/oss-sec/2014/q2/130
CVE ID: CVE-2014-2897 State: PUBLISHED Published: 2020-01-28T15:41:59 Last Updated: 2024-08-06T10:28:46.375Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SSL 3 HMAC functionality in wolfSSL CyaSSL 2.5.0 before 2.9.4 does not check the padding length when verification fails, which allows remote attackers to have unspecified impact via a crafted HMAC, which triggers an out-of-bounds read. Additional Analyst Notes: - CVE Program Container: References: - http://www.wolfssl.com/yaSSL/Blog/Entries/2014/4/11_wolfSSL_Security_Advisory__April_9%2C_2014.html - http://www.wolfssl.com/yaSSL/Docs-cyassl-changelog.html - http://seclists.org/oss-sec/2014/q2/126 - http://seclists.org/oss-s
//www.wolfssl.com/yaSSL/Docs-cyassl-changelog.html - http://seclists.org/oss-sec/2014/q2/126 - http://seclists.org/oss-sec/2014/q2/130
CVE ID: CVE-2014-2898 State: PUBLISHED Published: 2020-01-28T15:42:02 Last Updated: 2024-08-06T10:28:46.223Z Vendors: n/a Products: n/a Problem Types: n/a Description: wolfSSL CyaSSL before 2.9.4 allows remote attackers to have unspecified impact via multiple calls to the CyaSSL_read function which triggers an out-of-bounds read when an error occurs, related to not checking the return code and MAC verification failure. Additional Analyst Notes: - CVE Program Container: References: - http://www.wolfssl.com/yaSSL/Blog/Entries/2014/4/11_wolfSSL_Security_Advisory__April_9%2C_2014.html - http://www.wolfssl.com/yaSSL/Docs-cyassl-changelog.html - http://seclists.org/oss-sec/2014/q2/126 - http://sec
14.html - http://www.wolfssl.com/yaSSL/Docs-cyassl-changelog.html - http://seclists.org/oss-sec/2014/q2/126 - http://seclists.org/oss-sec/2014/q2/130
CVE ID: CVE-2014-2899 State: PUBLISHED Published: 2014-04-22T14:00:00 Last Updated: 2024-08-06T10:28:46.110Z Vendors: n/a Products: n/a Problem Types: n/a Description: wolfSSL CyaSSL before 2.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference) via (1) a request for the peer certificate when a certificate parsing failure occurs or (2) a client_key_exchange message when the ephemeral key is not found. Additional Analyst Notes: - CVE Program Container: References: - http://www.wolfssl.com/yaSSL/Blog/Entries/2014/4/11_wolfSSL_Security_Advisory__April_9%2C_2014.html - http://www.wolfssl.com/yaSSL/Docs-cyassl-changelog.html - https://security.gentoo.org/glsa/201612-
pril_9%2C_2014.html - http://www.wolfssl.com/yaSSL/Docs-cyassl-changelog.html - https://security.gentoo.org/glsa/201612-53 - http://seclists.org/oss-sec/2014/q2/126 - http://www.securityfocus.com/bid/66780 - http://seclists.org/oss-sec/2014/q2/130 - http://secunia.com/advisories/57743
CVE ID: CVE-2014-2900 State: PUBLISHED Published: 2014-04-22T14:00:00 Last Updated: 2024-08-06T10:28:46.282Z Vendors: n/a Products: n/a Problem Types: n/a Description: wolfSSL CyaSSL before 2.9.4 does not properly validate X.509 certificates with unknown critical extensions, which allows man-in-the-middle attackers to spoof servers via crafted X.509 certificate. Additional Analyst Notes: - CVE Program Container: References: - http://www.wolfssl.com/yaSSL/Blog/Entries/2014/4/11_wolfSSL_Security_Advisory__April_9%2C_2014.html - http://www.wolfssl.com/yaSSL/Docs-cyassl-changelog.html - https://security.gentoo.org/glsa/201612-53 - http://seclists.org/oss-sec/2014/q2/126 - http://www.securityfocu
og.html - https://security.gentoo.org/glsa/201612-53 - http://seclists.org/oss-sec/2014/q2/126 - http://www.securityfocus.com/bid/66780 - http://seclists.org/oss-sec/2014/q2/130 - http://secunia.com/advisories/57743
CVE ID: CVE-2014-2901 State: PUBLISHED Published: 2019-11-21T22:02:14 Last Updated: 2024-08-06T10:28:46.203Z Vendors: n/a Products: n/a Problem Types: n/a Description: wolfssl before 3.2.0 does not properly issue certificates for a server's hostname. Additional Analyst Notes: - CVE Program Container: References: - https://security-tracker.debian.org/tracker/CVE-2014-2901 - http://www.openwall.com/lists/oss-security/2014/04/18/2
CVE ID: CVE-2014-2902 State: PUBLISHED Published: 2019-11-21T22:05:02 Last Updated: 2024-08-06T10:28:46.244Z Vendors: n/a Products: n/a Problem Types: n/a Description: wolfssl before 3.2.0 does not properly authorize CA certificate for signing other certificates. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2014/04/18/2 - https://security-tracker.debian.org/tracker/CVE-2014-2902 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=792646
CVE ID: CVE-2014-2903 State: PUBLISHED Published: 2017-10-06T15:00:00 Last Updated: 2024-08-06T10:28:46.292Z Vendors: n/a Products: n/a Problem Types: n/a Description: CyaSSL does not check the key usage extension in leaf certificates, which allows remote attackers to spoof servers via a crafted server certificate not authorized for use in an SSL/TLS handshake. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/62604 - http://www.openwall.com/lists/oss-security/2014/04/18/2
CVE ID: CVE-2014-2904 State: PUBLISHED Published: 2019-11-21T22:08:20 Last Updated: 2024-08-06T10:28:46.086Z Vendors: n/a Products: n/a Problem Types: n/a Description: wolfssl before 3.2.0 has a server certificate that is not properly authorized for server authentication. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2014/04/18/2 - https://security-tracker.debian.org/tracker/CVE-2014-2904 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=792646
CVE ID: CVE-2014-2905 State: PUBLISHED Published: 2014-05-02T14:00:00 Last Updated: 2024-08-06T10:28:46.180Z Vendors: n/a Products: n/a Problem Types: n/a Description: fish (aka fish-shell) 1.16.0 before 2.1.1 does not properly check the credentials, which allows local users to gain privileges via the universal variable socket, related to /tmp/fishd.socket.user permissions. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2014/04/28/4 - https://github.com/fish-shell/fish-shell/issues/1436 - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00059.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg0007
/opensuse-security-announce/2019-09/msg00059.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00071.html
CVE ID: CVE-2014-2906 State: PUBLISHED Published: 2020-01-28T15:35:01 Last Updated: 2024-08-06T10:28:46.422Z Vendors: n/a Products: n/a Problem Types: n/a Description: The psub function in fish (aka fish-shell) 1.16.0 before 2.1.1 does not properly create temporary files, which allows local users to execute arbitrary commands via a temporary file with a predictable name. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2014/04/28/4 - https://github.com/fish-shell/fish-shell/issues/1437 - https://github.com/fish-shell/fish-shell/releases/tag/2.1.1
CVE ID: CVE-2014-2907 State: PUBLISHED Published: 2014-04-24T10:00:00 Last Updated: 2024-08-06T10:28:46.219Z Vendors: n/a Products: n/a Problem Types: n/a Description: The srtp_add_address function in epan/dissectors/packet-rtp.c in the RTP dissector in Wireshark 1.10.x before 1.10.7 does not properly update SRTP conversation data, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9885 - http://lists.opensuse.org/opensuse-updates/2014-05/msg00022.html - http://www.wireshark.org/security/wnpa-sec-2014-06.html - https://code.wir
.org/opensuse-updates/2014-05/msg00022.html - http://www.wireshark.org/security/wnpa-sec-2014-06.html - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=30ba425e7e95f7b61b3a3e5ff0c46e4be9d3d8d7
CVE ID: CVE-2014-2908 State: PUBLISHED Published: 2014-04-25T01:00:00 Last Updated: 2024-08-06T10:28:46.172Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://ics-cert.us-cert.gov/advisories/ICSA-14-114-02 - https://www.exploit-db.com/exploits/44687/ - http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-892012.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-892
l/de/forschungsfelder/siemens_security_advisory_ssa-892012.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-892012.pdf
CVE ID: CVE-2014-2909 State: PUBLISHED Published: 2014-04-25T01:00:00 Last Updated: 2024-08-06T10:28:46.174Z Vendors: n/a Products: n/a Problem Types: n/a Description: CRLF injection vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x allows remote attackers to inject arbitrary HTTP headers via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://ics-cert.us-cert.gov/advisories/ICSA-14-114-02 - http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-892012.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-892012.pdf
CVE ID: CVE-2014-2913 State: PUBLISHED Published: 2014-05-07T10:00:00 Last Updated: 2024-08-06T10:28:46.232Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incomplete blacklist vulnerability in nrpe.c in Nagios Remote Plugin Executor (NRPE) 2.15 and earlier allows remote attackers to execute arbitrary commands via a newline character in the -a option to libexec/check_nrpe. NOTE: this issue is disputed by multiple parties. It has been reported that the vendor allows newlines as "expected behavior." Also, this issue can only occur when the administrator enables the "dont_blame_nrpe" option in nrpe.conf despite the "HIGH security risk" warning within the comments Additional Analyst
e "dont_blame_nrpe" option in nrpe.conf despite the "HIGH security risk" warning within the comments Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-updates/2014-05/msg00014.html - http://www.securityfocus.com/bid/66969 - http://seclists.org/oss-sec/2014/q2/155 - http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166528.html - http://lists.opensuse.org/opensuse-updates/2014-05/msg00005.html - http://lists.opensuse.org/opensuse-security-announce/2014-05/msg00011.html - http://seclists.org/oss-sec/2014/q2/154 - http://seclists.org/fulldisclosure/2014/Apr/240 - http://seclists.org/fulldisclosure/2014/Apr/242
CVE ID: CVE-2014-2914 State: PUBLISHED Published: 2020-01-28T15:21:21 Last Updated: 2024-08-06T10:28:46.205Z Vendors: n/a Products: n/a Problem Types: n/a Description: fish (aka fish-shell) 2.0.0 before 2.1.1 does not restrict access to the configuration service (aka fish_config), which allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by set_prompt. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fish-shell/fish-shell/issues/1438 - http://www.openwall.com/lists/oss-security/2014/04/28/4
CVE ID: CVE-2014-2915 State: PUBLISHED Published: 2014-04-24T14:00:00 Last Updated: 2024-08-06T10:28:46.393Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xen 4.4.x, when running on ARM systems, does not properly restrict access to hardware features, which allows local guest users to cause a denial of service (host or guest crash) via unspecified vectors, related to (1) cache control, (2) coprocessors, (3) debug registers, and (4) other unspecified registers. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1030135 - http://xenbits.xen.org/xsa/advisory-93.html - http://www.openwall.com/lists/oss-security/2014/04/23/2 - http://www
135 - http://xenbits.xen.org/xsa/advisory-93.html - http://www.openwall.com/lists/oss-security/2014/04/23/2 - http://www.openwall.com/lists/oss-security/2014/04/22/10
CVE ID: CVE-2014-2916 State: PUBLISHED Published: 2014-05-05T16:00:00 Last Updated: 2024-08-06T10:28:46.208Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in the subscription page editor (spageedit) in phpList before 3.0.6 allows remote attackers to hijack the authentication of administrators via a request to admin/. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/57893 - http://labs.davidsopas.com/2014/04/phplist-csrf-on-subscription-page.html - http://www.phplist.com/?lid=638 - http://www.securitytracker.com/id/1030191
CVE ID: CVE-2014-2921 State: PUBLISHED Published: 2014-04-21T22:00:00 Last Updated: 2024-08-06T10:28:46.037Z Vendors: n/a Products: n/a Problem Types: n/a Description: The getObjectByToken function in Newsletter.php in the Pimcore_Tool_Newsletter module in pimcore 1.4.9 through 2.0.0 does not properly handle an object obtained by unserializing Lucene search data, which allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via vectors involving a Zend_Pdf_ElementFactory_Proxy object and a pathname with a trailing \0 character. Additional Analyst Notes: - CVE Program Container: References: - http://www.pimcore.org/en/resources/blog/pimcore+2.2+released_b442
Analyst Notes: - CVE Program Container: References: - http://www.pimcore.org/en/resources/blog/pimcore+2.2+released_b442 - http://openwall.com/lists/oss-security/2014/04/21/1 - https://github.com/pedrib/PoC/blob/master/pimcore-2.1.0.txt
CVE ID: CVE-2014-2922 State: PUBLISHED Published: 2014-04-21T22:00:00 Last Updated: 2024-08-06T10:28:46.122Z Vendors: n/a Products: n/a Problem Types: n/a Description: The getObjectByToken function in Newsletter.php in the Pimcore_Tool_Newsletter module in pimcore 1.4.9 through 2.1.0 does not properly handle an object obtained by unserializing a pathname, which allows remote attackers to conduct PHP object injection attacks and delete arbitrary files via vectors involving a Zend_Http_Response_Stream object. Additional Analyst Notes: - CVE Program Container: References: - http://www.pimcore.org/en/resources/blog/pimcore+2.2+released_b442 - http://openwall.com/lists/oss-security/2014/04/21/1 -
tp://www.pimcore.org/en/resources/blog/pimcore+2.2+released_b442 - http://openwall.com/lists/oss-security/2014/04/21/1 - https://github.com/pedrib/PoC/blob/master/pimcore-2.1.0.txt
CVE ID: CVE-2014-2925 State: PUBLISHED Published: 2014-04-21T14:00:00 Last Updated: 2024-08-06T10:28:46.391Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Advanced_Wireless_Content.asp in ASUS RT-AC68U and other RT series routers with firmware before 3.0.0.4.374.5047 allows remote attackers to inject arbitrary web script or HTML via the current_page parameter to apply.cgi. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2014/Apr/59 - http://support.asus.com/download.aspx?m=RT-N66U+%28VER.B1%29 - http://www.asus.com/Networking/RTAC68U/HelpDesk_Download/ - https://support.t-mobile.com/d
aspx?m=RT-N66U+%28VER.B1%29 - http://www.asus.com/Networking/RTAC68U/HelpDesk_Download/ - https://support.t-mobile.com/docs/DOC-21994 - http://www.securityfocus.com/bid/66669
CVE ID: CVE-2014-2926 State: PUBLISHED Published: 2014-07-14T21:00:00 Last Updated: 2024-08-06T10:28:46.480Z Vendors: n/a Products: n/a Problem Types: n/a Description: kapfa.sys in Kaseya Virtual System Administrator (VSA) 6.5 before 6.5.0.17 and 7.0 before 7.0.0.16 allows local users to cause a denial of service (NULL pointer dereference and application crash) via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/204988
CVE ID: CVE-2014-2927 State: PUBLISHED Published: 2014-10-15T14:00:00 Last Updated: 2024-08-06T10:28:46.416Z Vendors: n/a Products: n/a Problem Types: n/a Description: The rsync daemon in F5 BIG-IP 11.6 before 11.6.0, 11.5.1 before HF3, 11.5.0 before HF4, 11.4.1 before HF4, 11.4.0 before HF7, 11.3.0 before HF9, and 11.2.1 before HF11 and Enterprise Manager 3.x before 3.1.1 HF2, when configured in failover mode, does not require authentication, which allows remote attackers to read or write to arbitrary files via a cmi request to the ConfigSync IP address. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/kb/en-us/solutions/public/15000/200/sol15236.html
Notes: - CVE Program Container: References: - https://support.f5.com/kb/en-us/solutions/public/15000/200/sol15236.html - http://www.security-assessment.com/files/documents/advisory/F5_Unauthenticated_rsync_access_to_Remote_Root_Code_Execution.pdf - http://www.exploit-db.com/exploits/34465
CVE ID: CVE-2014-2928 State: PUBLISHED Published: 2014-05-12T14:00:00 Last Updated: 2024-08-06T10:28:46.191Z Vendors: n/a Products: n/a Problem Types: n/a Description: The iControl API in F5 BIG-IP LTM, APM, ASM, GTM, Link Controller, and PSM 10.0.0 through 10.2.4 and 11.0.0 through 11.5.1, BIG-IP AAM 11.4.0 through 11.5.1, BIG-IP AFM and PEM 11.3.0 through 11.5.1, BIG-IP Analytics 11.0.0 through 11.5.1, BIG-IP Edge Gateway, WebAccelerator, WOM 10.1.0 through 10.2.4 and 11.0.0 through 11.3.0, Enterprise Manager 2.1.0 through 2.3.0 and 3.0.0 through 3.1.1, and BIG-IQ Cloud, Device, and Security 4.0.0 through 4.3.0 allows remote administrators to execute arbitrary commands via shell metacharac
Device, and Security 4.0.0 through 4.3.0 allows remote administrators to execute arbitrary commands via shell metacharacters in the hostname element in a SOAP request. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2014/May/32 - http://www.exploit-db.com/exploits/34927 - http://support.f5.com/kb/en-us/solutions/public/15000/200/sol15220.html - http://www.osvdb.org/106728
CVE ID: CVE-2014-2933 State: PUBLISHED Published: 2014-05-08T10:00:00 Last Updated: 2024-08-06T10:28:45.999Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in dirmng/index.php in Caldera 9.20 allows remote attackers to access arbitrary directories via a crafted pathname. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/693092
CVE ID: CVE-2014-2934 State: PUBLISHED Published: 2014-05-08T10:00:00 Last Updated: 2024-08-06T10:28:46.332Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in Caldera 9.20 allow remote attackers to execute arbitrary SQL commands via the tr parameter to (1) costview2/jobs.php or (2) costview2/printers.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/693092
CVE ID: CVE-2014-2935 State: PUBLISHED Published: 2014-05-08T10:00:00 Last Updated: 2024-08-06T10:28:46.248Z Vendors: n/a Products: n/a Problem Types: n/a Description: costview3/xmlrpc_server/xmlrpc.php in CostView in Caldera 9.20 allows remote attackers to execute arbitrary commands via shell metacharacters in a methodCall element in a PHP XMLRPC request. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/67252 - http://www.kb.cert.org/vuls/id/693092