Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2014-9448 State: PUBLISHED Published: 2015-01-02T20:00:00Z Last Updated: 2024-09-16T18:18:45.565Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in Mini-stream RM-MP3 Converter 3.1.2.1.2010.03.30 allows remote attackers to execute arbitrary code or cause a denial of service (crash) via a long string in a WAX file. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/35377 - http://www.exploit-db.com/exploits/35105 - http://osvdb.org/show/osvdb/81080
CVE ID: CVE-2014-9449 State: PUBLISHED Published: 2015-01-02T20:00:00 Last Updated: 2024-08-06T13:47:41.536Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the RiffVideo::infoTagsHandler function in riffvideo.cpp in Exiv2 0.24 allows remote attackers to cause a denial of service (crash) via a long IKEY INFO tag value in an AVI file. Additional Analyst Notes: - CVE Program Container: References: - http://www.ubuntu.com/usn/USN-2454-1 - http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148382.html - http://dev.exiv2.org/issues/960 - http://secunia.com/advisories/61801 - https://security.gentoo.org/glsa/201507-03 - http://www.securityfocus.com
es/960 - http://secunia.com/advisories/61801 - https://security.gentoo.org/glsa/201507-03 - http://www.securityfocus.com/bid/71912 - http://dev.exiv2.org/projects/exiv2/repository/diff?rev=3264&rev_to=3263
CVE ID: CVE-2014-9450 State: PUBLISHED Published: 2015-01-02T20:00:00Z Last Updated: 2024-09-16T22:46:01.055Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in chart_bar.php in the frontend in Zabbix before 1.8.22, 2.0.x before 2.0.14, and 2.2.x before 2.2.8 allow remote attackers to execute arbitrary SQL commands via the (1) itemid or (2) periods parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.zabbix.com/rn1.8.22.php - http://secunia.com/advisories/61554 - https://support.zabbix.com/browse/ZBX-8582 - http://www.zabbix.com/rn2.0.14.php - http://www.zabbix.com/rn2.2.8.php
CVE ID: CVE-2014-9451 State: PUBLISHED Published: 2015-01-02T20:00:00 Last Updated: 2024-08-06T13:47:41.513Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple stack-based buffer overflows in the DIVA web service API (/webservice) in VDG Security SENSE (formerly DIVA) 2.3.13 allow remote attackers to execute arbitrary code via the (1) user or (2) password parameter in an AuthenticateUser request. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2014/Dec/76 - http://www.securityfocus.com/bid/71736 - https://exchange.xforce.ibmcloud.com/vulnerabilities/99334 - http://packetstormsecurity.com/files/129656/VDG-Security-SENSE-2.3.
exchange.xforce.ibmcloud.com/vulnerabilities/99334 - http://packetstormsecurity.com/files/129656/VDG-Security-SENSE-2.3.13-File-Disclosure-Bypass-Buffer-Overflow.html - https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20141218-0_VDG_Security_SENSE_Multiple_critical_vulnerabilities_v10.txt
CVE ID: CVE-2014-9452 State: PUBLISHED Published: 2015-01-02T20:00:00 Last Updated: 2024-08-06T13:47:40.318Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in VDG Security SENSE (formerly DIVA) 2.3.13 allows remote attackers to read arbitrary files via a .. (dot dot) in the default URI to images/. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2014/Dec/76 - http://www.securityfocus.com/bid/71736 - http://packetstormsecurity.com/files/129656/VDG-Security-SENSE-2.3.13-File-Disclosure-Bypass-Buffer-Overflow.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/99331 - https://www.sec-consult
osure-Bypass-Buffer-Overflow.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/99331 - https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20141218-0_VDG_Security_SENSE_Multiple_critical_vulnerabilities_v10.txt
CVE ID: CVE-2014-9453 State: PUBLISHED Published: 2015-01-02T20:00:00 Last Updated: 2024-08-06T13:47:41.366Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in simple-visitor-stat.php in the Simple visitor stat plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) HTTP User-Agent or (2) HTTP Referer header. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/129502/WordPress-Simple-Visitor-Stat-Cross-Site-Scripting.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/99421
CVE ID: CVE-2014-9454 State: PUBLISHED Published: 2015-01-02T20:00:00 Last Updated: 2024-08-06T13:47:40.977Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Simple Sticky Footer plugin before 1.3.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings via unspecified vectors or conduct cross-site scripting (XSS) attacks via the (2) simple_sf_width or (3) simple_sf_style parameter in the simple-simple-sticky-footer page to wp-admin/themes.php. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com
-admin/themes.php. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/99374 - http://packetstormsecurity.com/files/129503/WordPress-Simple-Sticky-Footer-1.3.2-CSRF-XSS.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/99375 - https://wordpress.org/plugins/simple-sticky-footer/changelog/
CVE ID: CVE-2014-9455 State: PUBLISHED Published: 2015-01-02T20:00:00Z Last Updated: 2024-09-16T18:48:17.929Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in showads.php in CTS Projects & Software ClassAd 3.0 allows remote attackers to execute arbitrary SQL commands via the catid parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/129451/ClassAd-3.0-SQL-Injection.html
CVE ID: CVE-2014-9456 State: PUBLISHED Published: 2015-01-02T20:00:00 Last Updated: 2024-08-06T13:47:40.939Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in NotePad++ 6.6.9 allows remote attackers to have unspecified impact via a long Time attribute in an Event element in an XML file. NOTE: this issue was originally incorrectly mapped to CVE-2014-1004; see CVE-2014-1004 for more information. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/35589 - http://www.securityfocus.com/bid/88191
CVE ID: CVE-2014-9457 State: PUBLISHED Published: 2015-01-02T20:00:00Z Last Updated: 2024-09-16T20:58:58.020Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in classes/mono_display.class.php in PMB 4.1.3 and earlier allows remote authenticated users to execute arbitrary SQL commands via the id parameter to catalog.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/35625
CVE ID: CVE-2014-9458 State: PUBLISHED Published: 2015-01-02T20:00:00 Last Updated: 2024-08-06T13:47:41.289Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in the GDB debugger module in Hex-Rays IDA Pro before 6.6 cumulative fix 2014-12-24 allows remote GDB servers to have unspecified impact via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.hex-rays.com/vulnfix.shtml - https://www.hex-rays.com/bugbounty.shtml - http://secunia.com/advisories/61863 - http://www.securityfocus.com/bid/87981
CVE ID: CVE-2014-9459 State: PUBLISHED Published: 2015-01-02T20:00:00 Last Updated: 2024-08-06T13:47:40.873Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in the AdminObserver function in e107_admin/users.php in e107 2.0 alpha2 allows remote attackers to hijack the authentication of administrators for requests that add users to the administrator group via the id parameter in an admin action. Additional Analyst Notes: - CVE Program Container: References: - http://sroesemann.blogspot.de/2014/12/sroeadv-2014-04.html - http://packetstormsecurity.com/files/129751/e107-2.0-Alpha2-Cross-Site-Request-Forgery.html - https://github.com/e107i
- http://packetstormsecurity.com/files/129751/e107-2.0-Alpha2-Cross-Site-Request-Forgery.html - https://github.com/e107inc/e107/commit/9249f892b1e635979db2a830393694fb73531080 - http://seclists.org/fulldisclosure/2014/Dec/124
CVE ID: CVE-2014-9460 State: PUBLISHED Published: 2015-01-02T20:00:00 Last Updated: 2024-08-06T13:47:40.947Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the WP-ViperGB plugin before 1.3.11 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings via unspecified vectors or conduct cross-site scripting (XSS) attacks via the (2) vgb_page or (3) vgb_items_per_pg parameter in the wp-vipergb page to wp-admin/options-general.php. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/99439
tional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/99439 - https://wordpress.org/plugins/wp-vipergb/changelog/ - http://packetstormsecurity.com/files/129501/WordPress-WP-ViperGB-1.3.10-CSRF-XSS.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/99440
CVE ID: CVE-2014-9461 State: PUBLISHED Published: 2015-01-02T22:00:00Z Last Updated: 2024-09-16T16:58:23.076Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in models/Cart66.php in the Cart66 Lite plugin before 1.5.4 for WordPress allows remote authenticated users to read arbitrary files via a .. (dot dot) in the member_download action to wp-admin/admin-ajax.php. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/cart66-lite/changelog/ - https://research.g0blin.co.uk/g0blin-00021/ - https://plugins.trac.wordpress.org/changeset/1052064/cart66-lite
CVE ID: CVE-2014-9462 State: PUBLISHED Published: 2015-03-31T14:00:00 Last Updated: 2024-08-06T13:47:41.369Z Vendors: n/a Products: n/a Problem Types: n/a Description: The _validaterepo function in sshpeer in Mercurial before 3.2.4 allows remote attackers to execute arbitrary commands via a crafted repository name in a clone command. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201612-19 - http://chargen.matasano.com/chargen/2015/3/17/this-new-vulnerability-mercurial-command-injection-cve-2014-9462.html - http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html - http://lists.opensuse.org/opensuse-updates/2015-03/msg0
e.com/technetwork/topics/security/bulletinjul2015-2511963.html - http://lists.opensuse.org/opensuse-updates/2015-03/msg00085.html - http://www.osvdb.org/119816 - http://mercurial.selenic.com/wiki/WhatsNew - http://www.debian.org/security/2015/dsa-3257
CVE ID: CVE-2014-9463 State: PUBLISHED Published: 2017-09-15T20:00:00 Last Updated: 2024-08-06T13:47:40.329Z Vendors: n/a Products: n/a Problem Types: n/a Description: functions_vbseo_hook.php in the VBSEO module for vBulletin allows remote authenticated users to execute arbitrary code via the HTTP Referer header to visitormessage.php. Additional Analyst Notes: - CVE Program Container: References: - https://blog.sucuri.net/2015/01/serious-vulnerability-on-vbseo.html - https://www.exploit-db.com/exploits/36232/
CVE ID: CVE-2014-9464 State: PUBLISHED Published: 2015-01-03T22:00:00Z Last Updated: 2024-09-16T17:23:20.712Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Category.php in Microweber CMS 0.95 before 20141209 allows remote attackers to execute arbitrary SQL commands via the category parameter when displaying a category, related to the $parent_id variable. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/microweber/microweber/commit/4ee09f9dda35cd1b15daa351f335c2a4a0538d29 - https://www.youtube.com/watch?v=SSE8Xj_-QaQ
CVE ID: CVE-2014-9465 State: PUBLISHED Published: 2015-02-19T15:00:00 Last Updated: 2024-08-06T13:47:41.359Z Vendors: n/a Products: n/a Problem Types: n/a Description: senddocument.php in Zarafa WebApp before 2.0 beta 3 and WebAccess in Zarafa Collaboration Platform (ZCP) 7.x before 7.1.12 beta 1 and 7.2.x before 7.2.0 beta 1 allows remote attackers to cause a denial of service (/tmp disk consumption) by uploading a large number of files. Additional Analyst Notes: - CVE Program Container: References: - http://www.mandriva.com/security/advisories?name=MDVSA-2015:040 - http://download.zarafa.com/community/beta/7.1/changelog-7.1.txt - http://www.openwall.com/lists/oss-security/2015/01/03/10 - h
/download.zarafa.com/community/beta/7.1/changelog-7.1.txt - http://www.openwall.com/lists/oss-security/2015/01/03/10 - https://jira.zarafa.com/browse/ZCP-12596 - http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156228.html - http://security.robert-scheck.de/cve-2014-9465-zarafa/ - http://www.openwall.com/lists/oss-security/2014/12/07/2 - http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156112.html - http://advisories.mageia.org/MGASA-2015-0049.html - https://bugzilla.redhat.com/show_bug.cgi?id=1139442 - http://download.zarafa.com/community/beta/7.2/changelog-7.2.txt
CVE ID: CVE-2014-9466 State: PUBLISHED Published: 2015-02-17T15:00:00 Last Updated: 2024-08-06T13:47:41.621Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open-Xchange (OX) AppSuite and Server before 7.4.2-rev42, 7.6.0 before 7.6.0-rev36, and 7.6.1 before 7.6.1-rev14 does not properly handle directory permissions, which allows remote authenticated users to read files via unspecified vectors, related to the "folder identifier." Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/72587 - http://www.securitytracker.com/id/1031744 - http://www.securityfocus.com/archive/1/534695/100/0/threaded - https://exchange.xforce.ibmcloud.com/vulner
/id/1031744 - http://www.securityfocus.com/archive/1/534695/100/0/threaded - https://exchange.xforce.ibmcloud.com/vulnerabilities/100867 - http://packetstormsecurity.com/files/130379/Open-Xchange-Server-6-OX-AppSuite-7.6.1-Exposure.html
CVE ID: CVE-2014-9468 State: PUBLISHED Published: 2015-02-19T15:00:00 Last Updated: 2024-08-06T13:47:41.120Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in InstantASP InstantForum.NET 4.1.3, 4.1.2, 4.1.1, 4.0.0, 4.1.0, and 3.4.0 allow remote attackers to inject arbitrary web script or HTML via the SessionID parameter to (1) Join.aspx or (2) Logon.aspx. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2015/Feb/70 - http://www.securitytracker.com/id/1033434 - http://tetraph.com/security/cves/cve-2014-9468-instantasp-instantforum-net-multiple-xss-cross-site-scripting-security-vu
http://tetraph.com/security/cves/cve-2014-9468-instantasp-instantforum-net-multiple-xss-cross-site-scripting-security-vulnerabilities/
CVE ID: CVE-2014-9469 State: PUBLISHED Published: 2017-08-28T15:00:00 Last Updated: 2024-08-06T13:47:41.431Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in vBulletin 3.5.4, 3.6.0, 3.6.7, 3.8.7, 4.2.2, 5.0.5, and 5.1.3. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/72592 - http://packetstormsecurity.com/files/130393/vBulletin-5.1.3-Cross-Site-Scripting.html - http://seclists.org/fulldisclosure/2015/Feb/49
CVE ID: CVE-2014-9470 State: PUBLISHED Published: 2020-02-08T16:03:43 Last Updated: 2024-08-06T13:47:40.347Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the loadForm function in Frontend/Modules/Search/Actions/Index.php in Fork CMS before 3.8.4 allows remote attackers to inject arbitrary web script or HTML via the q_widget parameter to en/search. Additional Analyst Notes: - CVE Program Container: References: - http://www.itas.vn/news/itas-team-found-out-a-cross-site-scripting-vulnerability-in-fork-cms-70.html - http://seclists.org/fulldisclosure/2015/Jan/38 - http://www.fork-cms.com/blog/detail/fork-3.8.4-released - https://github.co
://seclists.org/fulldisclosure/2015/Jan/38 - http://www.fork-cms.com/blog/detail/fork-3.8.4-released - https://github.com/forkcms/forkcms/commit/4a7814762adf4f56f932d95146c7e4126d872114 - https://github.com/forkcms/forkcms/issues/1018s - http://www.securityfocus.com/bid/72017
CVE ID: CVE-2014-9471 State: PUBLISHED Published: 2015-01-16T16:00:00 Last Updated: 2024-08-06T13:47:41.549Z Vendors: n/a Products: n/a Problem Types: n/a Description: The parse_datetime function in GNU coreutils allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted date string, as demonstrated by the "--date=TZ="123"345" @1" string to the touch or date command. Additional Analyst Notes: - CVE Program Container: References: - http://www.mandriva.com/security/advisories?name=MDVSA-2015:179 - http://advisories.mageia.org/MGASA-2015-0029.html - http://www.openwall.com/lists/oss-security/2014/11/25/4 - http://debbugs.gnu.org/cgi/bugreport.c
/MGASA-2015-0029.html - http://www.openwall.com/lists/oss-security/2014/11/25/4 - http://debbugs.gnu.org/cgi/bugreport.cgi?bug=16872 - https://security.gentoo.org/glsa/201612-22 - http://www.openwall.com/lists/oss-security/2014/11/25/1 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=766147 - http://www.openwall.com/lists/oss-security/2015/01/03/11 - http://secunia.com/advisories/62226 - http://ubuntu.com/usn/usn-2473-1
CVE ID: CVE-2014-9472 State: PUBLISHED Published: 2015-03-09T14:00:00 Last Updated: 2024-08-06T13:47:40.986Z Vendors: n/a Products: n/a Problem Types: n/a Description: The email gateway in RT (aka Request Tracker) 3.0.0 through 4.x before 4.0.23 and 4.2.x before 4.2.10 allows remote attackers to cause a denial of service (CPU and disk consumption) via a crafted email. Additional Analyst Notes: - CVE Program Container: References: - http://blog.bestpractical.com/2015/02/security-vulnerabilities-in-rt.html - http://www.securityfocus.com/bid/72832 - http://www.debian.org/security/2015/dsa-3176 - http://lists.fedoraproject.org/pipermail/package-announce/2015-March/154047.html - http://lists.fedo
ity/2015/dsa-3176 - http://lists.fedoraproject.org/pipermail/package-announce/2015-March/154047.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154213.html
CVE ID: CVE-2014-9473 State: PUBLISHED Published: 2015-01-08T00:00:00 Last Updated: 2024-08-06T13:47:40.997Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted file upload vulnerability in lib_nonajax.php in the CformsII plugin 14.7 and earlier for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension via the cf_uploadfile2[] parameter, then accessing the file via a direct request to the file in the default upload directory. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/cforms2/changelog/ - http://www.securityfocus.com/archive/1/534349/30/0/threaded
CVE ID: CVE-2014-9474 State: PUBLISHED Published: 2017-10-09T14:00:00 Last Updated: 2024-08-06T13:47:41.281Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the mpfr_strtofr function in GNU MPFR before 3.1.2-p11 allows context-dependent attackers to have unspecified impact via vectors related to incorrect documentation for mpn_set_str. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/71542 - http://www.openwall.com/lists/oss-security/2015/01/03/12 - http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147745.html - https://gmplib.org/list-archives/gmp-bugs/2013-December/003267.html - http://www.m
e-announce/2015-January/147745.html - https://gmplib.org/list-archives/gmp-bugs/2013-December/003267.html - http://www.mpfr.org/mpfr-3.1.2/patch11 - https://gforge.inria.fr/scm/viewvc.php/mpfr?revision=9243&view=revision - http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147737.html - https://bugzilla.redhat.com/show_bug.cgi?id=1171701 - https://security.gentoo.org/glsa/201512-06
CVE ID: CVE-2014-9475 State: PUBLISHED Published: 2015-01-16T16:00:00 Last Updated: 2024-08-06T13:47:41.530Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in thumb.php in MediaWiki before 1.19.23, 1.2x before 1.22.15, 1.23.x before 1.23.8, and 1.24.x before 1.24.1 allows remote authenticated users to inject arbitrary web script or HTML via a wikitext message. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2014/dsa-3110 - http://www.openwall.com/lists/oss-security/2015/01/03/13 - http://www.openwall.com/lists/oss-security/2014/12/21/2 - http://www.mandriva.com/security/advisories?name=MDVSA-
3/13 - http://www.openwall.com/lists/oss-security/2014/12/21/2 - http://www.mandriva.com/security/advisories?name=MDVSA-2015:006 - https://lists.wikimedia.org/pipermail/mediawiki-announce/2014-December/000173.html
CVE ID: CVE-2014-9476 State: PUBLISHED Published: 2015-01-16T16:00:00 Last Updated: 2024-08-06T13:47:41.126Z Vendors: n/a Products: n/a Problem Types: n/a Description: MediaWiki 1.2x before 1.22.15, 1.23.x before 1.23.8, and 1.24.x before 1.24.1 allows remote attackers to bypass CORS restrictions in $wgCrossSiteAJAXdomains via a domain that has a partial match to an allowed origin, as demonstrated by "http://en.wikipedia.org.evilsite.example/." Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T77028 - http://www.openwall.com/lists/oss-security/2015/01/03/13 - http://www.openwall.com/lists/oss-security/2014/12/21/2 - http://www.mandriva.com/se
/lists/oss-security/2015/01/03/13 - http://www.openwall.com/lists/oss-security/2014/12/21/2 - http://www.mandriva.com/security/advisories?name=MDVSA-2015:006 - https://lists.wikimedia.org/pipermail/mediawiki-announce/2014-December/000173.html
CVE ID: CVE-2014-9477 State: PUBLISHED Published: 2015-01-16T16:00:00 Last Updated: 2024-08-06T13:47:40.370Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the Listings extension for MediaWiki allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) url parameter. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T77624 - http://www.openwall.com/lists/oss-security/2015/01/03/13 - http://www.openwall.com/lists/oss-security/2014/12/21/2 - https://lists.wikimedia.org/pipermail/mediawiki-announce/2014-December/000173.html
CVE ID: CVE-2014-9478 State: PUBLISHED Published: 2015-01-16T16:00:00 Last Updated: 2024-08-06T13:47:40.998Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the preview in the ExpandTemplates extension for MediaWiki, when $wgRawHTML is set to true, allows remote attackers to inject arbitrary web script or HTML via the wpInput parameter to the Special:ExpandTemplates page. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2015/01/03/13 - https://phabricator.wikimedia.org/T73111 - http://www.openwall.com/lists/oss-security/2014/12/21/2 - https://lists.wikimedia.org/pipermail/mediawi
dia.org/T73111 - http://www.openwall.com/lists/oss-security/2014/12/21/2 - https://lists.wikimedia.org/pipermail/mediawiki-announce/2014-December/000173.html