Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2014-9423 State: PUBLISHED Published: 2015-02-19T11:00:00 Last Updated: 2024-08-06T13:47:41.334Z Vendors: n/a Products: n/a Problem Types: n/a Description: The svcauth_gss_accept_sec_context function in lib/rpc/svc_auth_gss.c in MIT Kerberos 5 (aka krb5) 1.11.x through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 transmits uninitialized interposer data to clients, which allows remote attackers to obtain sensitive information from process heap memory by sniffing the network for data in a handle field. Additional Analyst Notes: - CVE Program Container: References: - http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151437.html - http://web.mit.edu/kerb
References: - http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151437.html - http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt - http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151103.html - http://www.debian.org/security/2015/dsa-3153 - http://lists.opensuse.org/opensuse-updates/2015-02/msg00044.html - http://rhn.redhat.com/errata/RHSA-2015-0439.html - http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00016.html - https://github.com/krb5/krb5/commit/5bb8a6b9c9eb8dd22bc9526751610aaa255ead9c - http://www.mandriva.com/security/advisories?name=MDVSA-2015:069 - http://www.ubuntu.com/usn/USN-2498-1 - http://lists.opensuse.org/ope
driva.com/security/advisories?name=MDVSA-2015:069 - http://www.ubuntu.com/usn/USN-2498-1 - http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00011.html - http://www.securityfocus.com/bid/72503 - http://web.mit.edu/kerberos/advisories/2015-001-patch-r113.txt
CVE ID: CVE-2014-9424 State: PUBLISHED Published: 2014-12-29T00:00:00Z Last Updated: 2024-09-16T16:59:15.215Z Vendors: n/a Products: n/a Problem Types: n/a Description: Double free vulnerability in the ssl_parse_clienthello_use_srtp_ext function in d1_srtp.c in LibreSSL before 2.1.2 allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering a certain length-verification error during processing of a DTLS handshake. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/robertbachmann/openbsd-libssl/commit/62a110d447bb8c16a4c69629e28a42e8c39fd7e0 - https://code.google.com/p/google-security-research/issues/detail?id=
l/commit/62a110d447bb8c16a4c69629e28a42e8c39fd7e0 - https://code.google.com/p/google-security-research/issues/detail?id=202
CVE ID: CVE-2014-9425 State: PUBLISHED Published: 2014-12-31T02:00:00 Last Updated: 2024-08-06T13:47:40.973Z Vendors: n/a Products: n/a Problem Types: n/a Description: Double free vulnerability in the zend_ts_hash_graceful_destroy function in zend_ts_hash.c in the Zend Engine in PHP through 5.5.20 and 5.6.x through 5.6.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=fbf3a6bc1abcc8a5b5226b0ad9464c37f11ddbd6 - http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html - http://www.oracle.com/technet
64c37f11ddbd6 - http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html - http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html - http://www.securityfocus.com/bid/71800 - https://support.apple.com/HT205267 - http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=24125f0f26f3787c006e4a51611ba33ee3b841cb - http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=2bcf69d073190e4f032d883f3416dea1b027a39e - https://security.gentoo.org/glsa/201503-03 - http://openwall.com/lists/oss-security/2014/12/29/6 - http://advisories.mageia.org/MGASA-2015-0040.html - https://bugs.php.net/bug.php?id=68676 - http://rhn.redhat.com/errata/RHSA-2015-1218.html
CVE ID: CVE-2014-9426 State: PUBLISHED Published: 2014-12-31T02:00:00 Last Updated: 2024-10-29T14:35:27.516Z Vendors: n/a Products: n/a Problem Types: n/a Description: The apprentice_load function in libmagic/apprentice.c in the Fileinfo component in PHP through 5.6.4 attempts to perform a free operation on a stack-based character array, which allows remote attackers to cause a denial of service (memory corruption or application crash) or possibly have unspecified other impact via unknown vectors. NOTE: this is disputed by the vendor because the standard erealloc behavior makes the free operation unreachable Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Referenc
akes the free operation unreachable Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=a72cd07f2983dc43a6bb35209dc4687852e53c09 - http://lists.opensuse.org/opensuse-updates/2015-02/msg00079.html - https://bugs.php.net/bug.php?id=68665 - http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=ef89ab2f99fbd9b7b714556d4f1f50644eb54191
CVE ID: CVE-2014-9427 State: PUBLISHED Published: 2015-01-03T02:00:00 Last Updated: 2024-08-06T13:47:41.005Z Vendors: n/a Products: n/a Problem Types: n/a Description: sapi/cgi/cgi_main.c in the CGI component in PHP through 5.4.36, 5.5.x through 5.5.20, and 5.6.x through 5.6.4, when mmap is used to read a .php file, does not properly consider the mapping's length during processing of an invalid file that begins with a # character and lacks a newline character, which causes an out-of-bounds read and might (1) allow remote attackers to obtain sensitive information from php-cgi process memory by leveraging the ability to upload a .php file or (2) trigger unexpected code execution if a valid PHP
i process memory by leveraging the ability to upload a .php file or (2) trigger unexpected code execution if a valid PHP script is present in memory locations adjacent to the mapping. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.php.net/bug.php?id=68618 - http://www.mandriva.com/security/advisories?name=MDVSA-2015:032 - http://marc.info/?l=bugtraq&m=144050155601375&w=2 - http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00029.html - http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html - http://openwall.com/lists/oss-security/2015/01/03/4 - http://marc.info/?l=bugtraq&m=143748090628601&w=2 - http://www.oracle.com/technetwork/t
ists/oss-security/2015/01/03/4 - http://marc.info/?l=bugtraq&m=143748090628601&w=2 - http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html - http://openwall.com/lists/oss-security/2014/12/31/6 - http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=f9ad3086693fce680fbe246e4a45aa92edd2ac35 - http://lists.opensuse.org/opensuse-updates/2015-02/msg00079.html - http://www.securityfocus.com/bid/71833 - https://support.apple.com/HT205267 - http://openwall.com/lists/oss-security/2015/01/01/1 - http://rhn.redhat.com/errata/RHSA-2015-1053.html - https://security.gentoo.org/glsa/201503-03 - http://advisories.mageia.org/MGASA-2015-0040.html - http://rhn.redhat.com/errata/RHSA-20
ity.gentoo.org/glsa/201503-03 - http://advisories.mageia.org/MGASA-2015-0040.html - http://rhn.redhat.com/errata/RHSA-2015-1066.html
CVE ID: CVE-2014-9428 State: PUBLISHED Published: 2015-01-02T21:00:00 Last Updated: 2024-08-06T13:47:40.368Z Vendors: n/a Products: n/a Problem Types: n/a Description: The batadv_frag_merge_packets function in net/batman-adv/fragmentation.c in the B.A.T.M.A.N. implementation in the Linux kernel through 3.18.1 uses an incorrect length field during a calculation of an amount of memory, which allows remote attackers to cause a denial of service (mesh-node system crash) via fragmented packets. Additional Analyst Notes: - CVE Program Container: References: - http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147864.html - http://www.ubuntu.com/usn/USN-2515-1 - http://www.openw
roject.org/pipermail/package-announce/2015-January/147864.html - http://www.ubuntu.com/usn/USN-2515-1 - http://www.openwall.com/lists/oss-security/2014/12/31/7 - http://www.spinics.net/lists/netdev/msg309425.html - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=5b6698b0e4a37053de35cc24ee695b98a7eb712b - https://github.com/torvalds/linux/commit/5b6698b0e4a37053de35cc24ee695b98a7eb712b - http://www.ubuntu.com/usn/USN-2518-1 - http://www.mandriva.com/security/advisories?name=MDVSA-2015:058 - http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147973.html - http://bugs.debian.org/774155 - https://lists.open-mesh.org/pipermail/b.a.t.m.a.n/2014-N
unce/2015-January/147973.html - http://bugs.debian.org/774155 - https://lists.open-mesh.org/pipermail/b.a.t.m.a.n/2014-November/012561.html - http://www.ubuntu.com/usn/USN-2517-1 - http://www.ubuntu.com/usn/USN-2516-1
CVE ID: CVE-2014-9429 State: PUBLISHED Published: 2014-12-31T22:00:00 Last Updated: 2024-08-06T13:47:41.206Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Smoothwall Express 3.1 and 3.0 SP3 allow remote attackers to inject arbitrary web script or HTML via the (1) PROFILENAME parameter in a Save action to httpd/cgi-bin/pppsetup.cgi or (2) COMMENT parameter in an Add action to httpd/cgi-bin/ddns.cgi. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/99404 - http://packetstormsecurity.com/files/129698/SmoothWall-3.1-Cross-Site-Request-Forgery-Cross-Site-Scripti
ilities/99404 - http://packetstormsecurity.com/files/129698/SmoothWall-3.1-Cross-Site-Request-Forgery-Cross-Site-Scripting.html
CVE ID: CVE-2014-9430 State: PUBLISHED Published: 2014-12-31T22:00:00 Last Updated: 2024-08-06T13:47:40.388Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in httpd/cgi-bin/vpn.cgi/vpnconfig.dat in Smoothwall Express 3.0 SP3 allows remote attackers to inject arbitrary web script or HTML via the COMMENT parameter in an Add action. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/99404 - http://packetstormsecurity.com/files/129698/SmoothWall-3.1-Cross-Site-Request-Forgery-Cross-Site-Scripting.html
CVE ID: CVE-2014-9431 State: PUBLISHED Published: 2014-12-31T22:00:00 Last Updated: 2024-08-06T13:47:41.580Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Smoothwall Express 3.1 and 3.0 SP3 allow remote attackers to hijack the authentication of administrators for requests that change the (1) admin or (2) dial password via a request to httpd/cgi-bin/changepw.cgi. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/99403 - http://packetstormsecurity.com/files/129698/SmoothWall-3.1-Cross-Site-Request-Forgery-Cross-Site-Scripting.html
CVE ID: CVE-2014-9432 State: PUBLISHED Published: 2014-12-31T22:00:00 Last Updated: 2024-08-06T13:47:40.386Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in templates/2k11/admin/overview.inc.tpl in Serendipity before 2.0-rc2 allow remote attackers to inject arbitrary web script or HTML via a blog comment in the QUERY_STRING to serendipity/index.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/129709/CMS-Serendipity-2.0-rc1-Cross-Site-Scripting.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/99464 - http://www.securityfocus.com/archive/1/534315/100/0/threaded
ttps://exchange.xforce.ibmcloud.com/vulnerabilities/99464 - http://www.securityfocus.com/archive/1/534315/100/0/threaded - http://blog.s9y.org/archives/259-Serendipity-2.0-rc2-released.html - http://sroesemann.blogspot.de/2014/12/bericht-zu-sroeadv-2014-02.html - http://seclists.org/fulldisclosure/2014/Dec/108 - https://github.com/s9y/Serendipity/commit/36cde3030aaa27a46bf94086e062dfe56b60230b
CVE ID: CVE-2014-9433 State: PUBLISHED Published: 2014-12-31T22:00:00 Last Updated: 2024-08-06T13:47:40.963Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in cms/front_content.php in Contenido before 4.9.6, when advanced mod rewrite (AMR) is disabled, allow remote attackers to inject arbitrary web script or HTML via the (1) idart, (2) lang, or (3) idcat parameter. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/61396 - http://www.securityfocus.com/archive/1/534320/100/0/threaded - http://seclists.org/fulldisclosure/2014/Dec/111 - http://sroesemann.blogspot.de/2014/12/report-for-adv
/100/0/threaded - http://seclists.org/fulldisclosure/2014/Dec/111 - http://sroesemann.blogspot.de/2014/12/report-for-advisory-sroeadv-2014-03.html - http://packetstormsecurity.com/files/129713/CMS-Contenido-4.9.5-Cross-Site-Scripting.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/99497 - http://www.contenido.org/de/cms/CONTENIDO/News/index-c-2044-3.html
CVE ID: CVE-2014-9434 State: PUBLISHED Published: 2015-01-02T19:00:00Z Last Updated: 2024-09-17T04:19:15.973Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in admin/managerrelated.php in the administrative backend in Absolut Engine 1.73 allows remote authenticated users to inject arbitrary web script or HTML via the title parameter. Additional Analyst Notes: - CVE Program Container: References: - http://sroesemann.blogspot.de/2014/12/sroeadv-2014-08.html - http://seclists.org/fulldisclosure/2014/Dec/131 - http://www.securityfocus.com/bid/71822
CVE ID: CVE-2014-9435 State: PUBLISHED Published: 2015-01-02T19:00:00Z Last Updated: 2024-09-16T17:58:30.860Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in Absolut Engine 1.73 allow remote authenticated users to execute arbitrary SQL commands via the (1) sectionID parameter to admin/managersection.php, (2) userID parameter to admin/edituser.php, (3) username parameter to admin/admin.php, or (4) title parameter to admin/managerrelated.php. Additional Analyst Notes: - CVE Program Container: References: - http://sroesemann.blogspot.de/2014/12/sroeadv-2014-08.html - http://seclists.org/fulldisclosure/2014/Dec/131 - http://www.securityfocus.c
.blogspot.de/2014/12/sroeadv-2014-08.html - http://seclists.org/fulldisclosure/2014/Dec/131 - http://www.securityfocus.com/bid/71822
CVE ID: CVE-2014-9436 State: PUBLISHED Published: 2015-01-02T19:00:00 Last Updated: 2024-08-06T13:47:40.373Z Vendors: n/a Products: n/a Problem Types: n/a Description: Absolute path traversal vulnerability in SysAid On-Premise before 14.4.2 allows remote attackers to read arbitrary files via a \\\\ (four backslashes) in the fileName parameter to getRdsLogFile. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/35593 - https://exchange.xforce.ibmcloud.com/vulnerabilities/99456 - http://packetstormsecurity.com/files/129705/SysAid-Server-Arbitrary-File-Disclosure.html - http://seclists.org/fulldisclosure/2014/Dec/99
CVE ID: CVE-2014-9437 State: PUBLISHED Published: 2015-01-02T19:00:00 Last Updated: 2024-08-06T13:47:40.353Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Sliding Social Icons plugin 1.61 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings via unspecified vectors or (2) conduct cross-site scripting (XSS) attacks via the sc_social_slider_margin parameter in a wpbs_save_settings action in the wpbs_panel page to wp-admin/admin.php. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabi
min.php. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/99510 - http://packetstormsecurity.com/files/129509
CVE ID: CVE-2014-9438 State: PUBLISHED Published: 2015-01-02T19:00:00 Last Updated: 2024-08-06T13:47:41.034Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in the Moderator Control Panel in vBulletin 4.2.2 allows remote attackers to hijack the authentication of administrators for requests that (1) ban a user via the username parameter in a dobanuser action to modcp/banning.php or (2) unban a user, (3) modify user profiles, edit a (4) post or (5) topic, or approve a (6) post or (7) topic via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/99472
itional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/99472 - http://packetstormsecurity.com/files/129619/vBulletin-Moderator-Control-Panel-4.2.2-CSRF.html - https://rstforums.com/forum/88810-csrf-vbulletin-modcp.rst
CVE ID: CVE-2014-9439 State: PUBLISHED Published: 2015-01-02T19:00:00 Last Updated: 2024-08-06T13:47:41.009Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Easy File Sharing Web Server 6.8 allows remote attackers to inject arbitrary web script or HTML via the username field during registration, which is not properly handled by forum.ghp. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/99532 - http://www.exploit-db.com/exploits/35626
CVE ID: CVE-2014-9440 State: PUBLISHED Published: 2015-01-02T19:00:00 Last Updated: 2024-08-06T13:47:41.368Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in browse.php in phpMyRecipes 1.2.2 allows remote attackers to execute arbitrary SQL commands via the category parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/35591 - https://exchange.xforce.ibmcloud.com/vulnerabilities/99531 - http://packetstormsecurity.com/files/129789/PHP-Address-Book-Cross-Site-Scripting-SQL-Injection.html
CVE ID: CVE-2014-9441 State: PUBLISHED Published: 2015-01-02T19:00:00 Last Updated: 2024-08-06T13:47:40.726Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Lightbox Photo Gallery plugin 1.0 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings via unspecified vectors or conduct cross-site scripting (XSS) attacks via the (2) ll__opt[image2_url] or (3) ll__opt[image3_url] parameter in a ll_save_settings action to wp-admin/admin-ajax.php. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulne
in-ajax.php. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/99490 - http://packetstormsecurity.com/files/129507
CVE ID: CVE-2014-9442 State: PUBLISHED Published: 2015-01-02T19:00:00Z Last Updated: 2024-09-16T20:57:37.331Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in models/Cart66Ajax.php in the Cart66 Lite plugin before 1.5.4 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the q parameter in a promotionProductSearch action to wp-admin/admin-ajax.php. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/cart66-lite/changelog/ - https://research.g0blin.co.uk/g0blin-00022/ - http://secunia.com/advisories/61942 - https://plugins.trac.wordpress.org/changeset/1052064/cart66-lite
CVE ID: CVE-2014-9443 State: PUBLISHED Published: 2015-01-02T19:00:00Z Last Updated: 2024-09-16T19:30:36.766Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Relevanssi plugin before 3.3.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/relevanssi/changelog/ - http://secunia.com/advisories/61744
CVE ID: CVE-2014-9444 State: PUBLISHED Published: 2015-01-02T20:00:00Z Last Updated: 2024-09-16T16:38:48.163Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Frontend Uploader plugin 0.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the errors[fu-disallowed-mime-type][0][name] parameter to the default URI. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2014/Dec/122 - http://www.securityfocus.com/bid/71808 - http://packetstormsecurity.com/files/129749/WordPress-Frontend-Uploader-0.9.2-Cross-Site-Scripting.html
CVE ID: CVE-2014-9445 State: PUBLISHED Published: 2015-01-02T20:00:00 Last Updated: 2024-08-06T13:47:41.252Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in incl/create.inc.php in Installatron GQ File Manager 0.2.5 allows remote attackers to execute arbitrary SQL commands via the create parameter to index.php. NOTE: this can be leveraged for cross-site scripting (XSS) attacks by creating a file that generates an error. NOTE: this issue was originally incorrectly mapped to CVE-2014-1137; see CVE-2014-1137 for more information. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/99366 -
onal Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/99366 - http://www.exploit-db.com/exploits/35584 - https://exchange.xforce.ibmcloud.com/vulnerabilities/99365
CVE ID: CVE-2014-9446 State: PUBLISHED Published: 2015-01-02T20:00:00Z Last Updated: 2024-09-16T18:54:07.207Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the Staff client in Koha before 3.16.6 and 3.18.x before 3.18.2 allow remote attackers to inject arbitrary web script or HTML via the sort_by parameter to the (1) opac parameter in opac-search.pl or (2) intranet parameter in catalogue/search.pl. Additional Analyst Notes: - CVE Program Container: References: - http://koha-community.org/koha-3-16-6-release/ - http://www.securityfocus.com/bid/71803 - http://koha-community.org/koha-3-18-2-release/ - http://secunia.com/advisor
/ - http://www.securityfocus.com/bid/71803 - http://koha-community.org/koha-3-18-2-release/ - http://secunia.com/advisories/61187 - http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13425
CVE ID: CVE-2014-9447 State: PUBLISHED Published: 2015-01-02T20:00:00 Last Updated: 2024-08-06T13:47:40.352Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the read_long_names function in libelf/elf_begin.c in elfutils 0.152 and 0.161 allows remote attackers to write to arbitrary files to the root directory via a / (slash) in a crafted archive, as demonstrated using the ar program. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/62560 - http://www.openwall.com/lists/oss-security/2014/12/29/2 - http://advisories.mageia.org/MGASA-2015-0033.html - http://lists.fedoraproject.org/pipermail/package-anno
2014/12/29/2 - http://advisories.mageia.org/MGASA-2015-0033.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148326.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148321.html - http://secunia.com/advisories/62661 - http://www.mandriva.com/security/advisories?name=MDVSA-2015:047 - https://git.fedorahosted.org/cgit/elfutils.git/commit/?id=147018e729e7c22eeabf15b82d26e4bf68a0d18e - http://secunia.com/advisories/61934 - https://lists.fedorahosted.org/pipermail/elfutils-devel/2014-December/004499.html - http://www.securityfocus.com/bid/71804