Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2014-2988 State: PUBLISHED Published: 2014-10-27T01:00:00 Last Updated: 2024-08-06T10:28:46.220Z Vendors: n/a Products: n/a Problem Types: n/a Description: EGroupware Enterprise Line (EPL) before 1.1.20140505, EGroupware Community Edition before 1.8.007.20140506, and EGroupware before 14.1 beta allows remote authenticated administrators to execute arbitrary PHP code via crafted callback values to the call_user_func PHP function, as demonstrated using the newsettings[system] parameter. NOTE: this can be exploited by remote attackers by leveraging CVE-2014-2987. Additional Analyst Notes: - CVE Program Container: References: - http://advisories.mageia.org/MGASA-2014-0221.html - http
dditional Analyst Notes: - CVE Program Container: References: - http://advisories.mageia.org/MGASA-2014-0221.html - http://www.mandriva.com/security/advisories?name=MDVSA-2015:087 - https://www.htbridge.com/advisory/HTB23212 - http://www.securityfocus.com/archive/1/532103/100/0/threaded
CVE ID: CVE-2014-2989 State: PUBLISHED Published: 2014-05-13T14:00:00 Last Updated: 2024-08-06T10:28:46.393Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in Open Assessment Technologies TAO 2.5.6 allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts via a request to Users/add. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/67291 - http://secunia.com/advisories/58539 - https://www.htbridge.com/advisory/HTB23211
CVE ID: CVE-2014-2992 State: PUBLISHED Published: 2014-04-26T01:00:00 Last Updated: 2024-08-06T10:28:46.364Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Misli.com application for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. Additional Analyst Notes: - CVE Program Container: References: - http://archives.neohapsis.com/archives/bugtraq/2014-04/0152.html - http://sceptive.com/p/mislicom-android-app-ssl-certificate-validation-weakness-
CVE ID: CVE-2014-2993 State: PUBLISHED Published: 2014-04-26T01:00:00 Last Updated: 2024-08-06T10:28:46.298Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Birebin.com application for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. Additional Analyst Notes: - CVE Program Container: References: - http://archives.neohapsis.com/archives/bugtraq/2014-04/0153.html - http://sceptive.com/p/birebincom-android-app-ssl-certificate-validation-weakness- - http://www.securityfocus.com/bid/67524
CVE ID: CVE-2014-2994 State: PUBLISHED Published: 2014-04-27T01:00:00 Last Updated: 2024-08-06T10:28:46.219Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in Acunetix Web Vulnerability Scanner (WVS) 8 build 20120704 allows remote attackers to execute arbitrary code via an HTML file containing an IMG element with a long URL (src attribute). Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/126306/Acunetix-8-Stack-Buffer-Overflow.html - http://www.acunetix.com/blog/news/misleading-reports-0-day-acunetix-wvs/ - https://www.youtube.com/watch?v=RHaMx8K1GeM - http://www.exploit-db.com/exploits/32997 - http
orts-0-day-acunetix-wvs/ - https://www.youtube.com/watch?v=RHaMx8K1GeM - http://www.exploit-db.com/exploits/32997 - http://an7isec.blogspot.co.il/2014/04/pown-noobs-acunetix-0day.html - http://packetstormsecurity.com/files/126307/Acunetix-8-Scanner-Buffer-Overflow.html - http://osandamalith.wordpress.com/2014/04/24/pwning-script-kiddies-acunetix-buffer-overflow/
CVE ID: CVE-2014-2995 State: PUBLISHED Published: 2014-10-17T22:00:00 Last Updated: 2024-08-06T10:28:46.386Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPress allow remote authenticated administrators to inject arbitrary web script or HTML via unspecified vectors, as demonstrated by the twitget_consumer_key parameter to wp-admin/options-general.php. Additional Analyst Notes: - CVE Program Container: References: - http://wordpress.org/plugins/twitget/changelog - https://exchange.xforce.ibmcloud.com/vulnerabilities/92392 - http://packetstormsecurity.com/files/126134 - ht
hangelog - https://exchange.xforce.ibmcloud.com/vulnerabilities/92392 - http://packetstormsecurity.com/files/126134 - http://seclists.org/fulldisclosure/2014/Apr/172 - https://security.dxw.com/advisories/csrfxss-vulnerability-in-twitget-3-3-1
CVE ID: CVE-2014-2996 State: PUBLISHED Published: 2014-04-25T20:00:00 Last Updated: 2024-08-06T10:28:46.288Z Vendors: n/a Products: n/a Problem Types: n/a Description: XCloner Standalone 3.5 and earlier, when enable_db_backup and sql_mem are enabled, allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the dbbackup_comp parameter in a generate action to index2.php. NOTE: it is not clear whether this issue crosses privilege boundaries, since administrators might already have the privileges to execute code. NOTE: this can be leveraged by remote attackers using CVE-2014-2579. Additional Analyst Notes: - CVE Program Container: References: - https:/
eraged by remote attackers using CVE-2014-2579. Additional Analyst Notes: - CVE Program Container: References: - https://www.htbridge.com/advisory/HTB23207 - http://www.exploit-db.com/exploits/32790 - http://www.securityfocus.com/archive/1/531780/100/0/threaded
CVE ID: CVE-2014-32537 State: REJECTED Published: 2015-01-13T11:00:00Z Last Updated: 2024-09-16T19:20:18.175Z Description: No description available.
CVE ID: CVE-2014-3000 State: PUBLISHED Published: 2014-05-02T14:00:00 Last Updated: 2024-08-06T10:28:46.352Z Vendors: n/a Products: n/a Problem Types: n/a Description: The TCP reassembly function in the inet module in FreeBSD 8.3 before p16, 8.4 before p9, 9.1 before p12, 9.2 before p5, and 10.0 before p2 allows remote attackers to cause a denial of service (undefined memory access and system crash) or possibly read system memory via multiple crafted packets, related to moving a reassemble queue entry to the segment list when the queue is full. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/67153 - http://secunia.com/advisories/58293 - http:
VE Program Container: References: - http://www.securityfocus.com/bid/67153 - http://secunia.com/advisories/58293 - http://www.debian.org/security/2014/dsa-2952 - http://secunia.com/advisories/59034 - http://www.securitytracker.com/id/1030172 - http://www.freebsd.org/security/advisories/FreeBSD-SA-14:08.tcp.asc
CVE ID: CVE-2014-3001 State: PUBLISHED Published: 2014-05-02T14:00:00 Last Updated: 2024-08-06T10:28:46.336Z Vendors: n/a Products: n/a Problem Types: n/a Description: The device file system (aka devfs) in FreeBSD 10.0 before p2 does not load default rulesets when booting, which allows context-dependent attackers to bypass intended restrictions by leveraging a jailed device node process. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1030171 - http://www.securityfocus.com/bid/67158 - http://www.freebsd.org/security/advisories/FreeBSD-SA-14:07.devfs.asc
CVE ID: CVE-2014-3003 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2014-3004 State: PUBLISHED Published: 2014-06-11T14:00:00 Last Updated: 2024-08-06T10:28:46.353Z Vendors: n/a Products: n/a Problem Types: n/a Description: The default configuration for the Xerces SAX Parser in Castor before 1.3.3 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XML document. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-updates/2014-06/msg00043.html - http://seclists.org/fulldisclosure/2014/May/142 - http://secunia.com/advisories/59427 - http://www.securityfocus.com/bid/67676 - https://www.oracle.com/security-alerts/cpujan2020.html - https://www.oracle.com/security
w.securityfocus.com/bid/67676 - https://www.oracle.com/security-alerts/cpujan2020.html - https://www.oracle.com/security-alerts/cpuoct2021.html - http://packetstormsecurity.com/files/126854/Castor-Library-XXE-Disclosure.html - https://quickview.cloudapps.cisco.com/quickview/bug/CSCvm56811
CVE ID: CVE-2014-3005 State: PUBLISHED Published: 2018-02-01T17:00:00 Last Updated: 2024-08-06T10:28:46.259Z Vendors: n/a Products: n/a Problem Types: n/a Description: XML external entity (XXE) vulnerability in Zabbix 1.8.x before 1.8.21rc1, 2.0.x before 2.0.13rc1, 2.2.x before 2.2.5rc1, and 2.3.x before 2.3.2 allows remote attackers to read arbitrary files or potentially execute arbitrary code via a crafted DTD in an XML request. Additional Analyst Notes: - CVE Program Container: References: - http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134885.html - http://www.securityfocus.com/bid/68075 - https://support.zabbix.com/browse/ZBX-8151 - http://lists.fedoraproject.org/p
- http://www.securityfocus.com/bid/68075 - https://support.zabbix.com/browse/ZBX-8151 - http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134909.html - http://seclists.org/fulldisclosure/2014/Jun/87 - https://bugzilla.redhat.com/show_bug.cgi?id=1110496 - https://web.archive.org/web/20140622034155/http://www.pnigos.com:80/?p=273
CVE ID: CVE-2014-3006 State: PUBLISHED Published: 2014-05-02T14:00:00 Last Updated: 2024-08-06T10:28:46.386Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sitepark Information Enterprise Server (IES) 2.9 before 2.9.6, when upgraded from an earlier version, does not properly restrict access, which allows remote attackers to change the manager account password and obtain sensitive information via a request to install/. Additional Analyst Notes: - CVE Program Container: References: - https://www.lsexperts.de/advisories/lse-2014-04-10.txt - http://seclists.org/fulldisclosure/2014/Apr/317 - http://www.securityfocus.com/bid/67165 - http://www.securityfocus.com/archive/1/531986/100/0/t
disclosure/2014/Apr/317 - http://www.securityfocus.com/bid/67165 - http://www.securityfocus.com/archive/1/531986/100/0/threaded
CVE ID: CVE-2014-3007 State: PUBLISHED Published: 2014-04-27T20:00:00Z Last Updated: 2024-09-17T02:06:15.551Z Vendors: n/a Products: n/a Problem Types: n/a Description: Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors related to CVE-2014-1932, possibly JpegImagePlugin.py. Additional Analyst Notes: - CVE Program Container: References: - http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-1932.html - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737059
CVE ID: CVE-2014-3008 State: PUBLISHED Published: 2014-04-28T14:00:00 Last Updated: 2024-08-06T10:28:46.287Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unitrends Enterprise Backup 7.3.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the comm parameter to recoveryconsole/bpl/snmpd.php. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/92642 - http://secunia.com/advisories/58001 - https://gist.github.com/brandonprry/10745756 - http://www.securityfocus.com/bid/66928 - http://seclists.org/fulldisclosure/2014/Apr/204 - http://www.exploit-db.com/exploits/32885
CVE ID: CVE-2014-3009 State: PUBLISHED Published: 2014-08-01T01:00:00 Last Updated: 2024-08-06T10:28:46.262Z Vendors: n/a Products: n/a Problem Types: n/a Description: The GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.0 through 11.0 and InfoSphere Master Data Management Server for Product Information Management 9.0 and 9.1 does not properly handle FRAME elements, which makes it easier for remote authenticated users to conduct phishing attacks via a crafted web site. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/92952 - http://www-01.ibm.com/support/docview.wss?uid=swg21677306
CVE ID: CVE-2014-3010 State: PUBLISHED Published: 2014-05-30T17:00:00 Last Updated: 2024-08-06T10:28:46.288Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Web UI in IBM WebSphere Service Registry and Repository (WSRR) 6.2, 6.3 before 6.3.0.6, 7.0 before 7.0.0.6, 7.5 before 7.5.0.5, and 8.0 before 8.0.0.3 allows remote attackers to inject arbitrary web script or HTML via a crafted URL. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg1IV56254 - http://secunia.com/advisories/58949 - https://exchange.xforce.ibmcloud.com/vulnerabilities/92999 - http://www-01.ibm.com/suppo
/secunia.com/advisories/58949 - https://exchange.xforce.ibmcloud.com/vulnerabilities/92999 - http://www-01.ibm.com/support/docview.wss?uid=swg21672829
CVE ID: CVE-2014-3011 State: PUBLISHED Published: 2014-06-27T23:00:00 Last Updated: 2024-08-06T10:28:46.364Z Vendors: n/a Products: n/a Problem Types: n/a Description: IBM OpenPages GRC Platform 6.1.0.1 before IF4 allows remote attackers to conduct link injection attacks via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg21676990
CVE ID: CVE-2014-3012 State: PUBLISHED Published: 2014-06-18T16:00:00 Last Updated: 2024-08-06T10:28:46.394Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple CRLF injection vulnerabilities in IBM Curam Social Program Management 5.2 SP1 through 6.0.5.4 allow remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified parameters to custom JSPs. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/59257 - http://www-01.ibm.com/support/docview.wss?uid=swg21675454 - https://exchange.xforce.ibmcloud.com/vulnerabilities/93010
CVE ID: CVE-2014-3013 State: PUBLISHED Published: 2014-06-18T16:00:00 Last Updated: 2024-08-06T10:28:46.385Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in IBM Curam Social Program Management 4.5 SP10 through 6.0.5.4 allow remote authenticated users to inject arbitrary web script or HTML via crafted input to a (1) custom JSP or (2) custom renderer. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg21675415 - http://secunia.com/advisories/59259 - https://exchange.xforce.ibmcloud.com/vulnerabilities/93011
CVE ID: CVE-2014-3014 State: PUBLISHED Published: 2014-05-26T01:00:00 Last Updated: 2024-08-06T10:28:46.412Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/93025 - http://www.securityfocus.com/bid/67597 - http://www-01.ibm.com/support/docview.wss?uid=swg21671201
CVE ID: CVE-2014-3015 State: PUBLISHED Published: 2014-05-24T01:00:00 Last Updated: 2024-08-06T10:28:46.381Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in the Web player in IBM Sametime Proxy Server and Web Client 9.0 through 9.0.0.1 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/93026 - http://www-01.ibm.com/support/docview.wss?uid=swg21673260
CVE ID: CVE-2014-3018 State: PUBLISHED Published: 2015-01-17T11:00:00 Last Updated: 2024-08-06T10:28:46.223Z Vendors: n/a Products: n/a Problem Types: n/a Description: IBM BladeCenter SAS Connectivity Module (aka NSSM) and SAS RAID Module (aka RSSM) before 1.3.3.006 allow remote attackers to cause a denial of service (reboot) via a flood of IP packets. Additional Analyst Notes: - CVE Program Container: References: - http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5096774 - https://exchange.xforce.ibmcloud.com/vulnerabilities/93052
CVE ID: CVE-2014-3019 State: PUBLISHED Published: 2015-01-17T11:00:00 Last Updated: 2024-08-06T10:28:46.450Z Vendors: n/a Products: n/a Problem Types: n/a Description: IBM BladeCenter SAS Connectivity Module (aka NSSM) and SAS RAID Module (aka RSSM) before 1.3.3.006 allow remote attackers to obtain blade and storage-pool access via a TELNET session. Additional Analyst Notes: - CVE Program Container: References: - http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5096774 - https://exchange.xforce.ibmcloud.com/vulnerabilities/93054
CVE ID: CVE-2014-3020 State: PUBLISHED Published: 2014-07-29T20:00:00 Last Updated: 2024-08-06T10:28:46.352Z Vendors: n/a Products: n/a Problem Types: n/a Description: install.sh in the Embedded WebSphere Application Server (eWAS) 7.0 before FP33 in IBM Tivoli Integrated Portal (TIP) 2.1 and 2.2 sets world-writable permissions for the installRoot directory tree, which allows local users to gain privileges via a Trojan horse program. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/59687 - http://www-01.ibm.com/support/docview.wss?uid=swg21680841 - http://www-01.ibm.com/support/docview.wss?uid=swg21679952 - http://www.securityfocus.com/bid/69034 -
s?uid=swg21680841 - http://www-01.ibm.com/support/docview.wss?uid=swg21679952 - http://www.securityfocus.com/bid/69034 - https://exchange.xforce.ibmcloud.com/vulnerabilities/93056 - http://www-01.ibm.com/support/docview.wss?uid=swg21680254 - http://secunia.com/advisories/60552 - http://secunia.com/advisories/59795
CVE ID: CVE-2014-3021 State: PUBLISHED Published: 2014-10-19T01:00:00 Last Updated: 2024-08-06T10:28:46.384Z Vendors: n/a Products: n/a Problem Types: n/a Description: IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.35, 8.0 before 8.0.0.10, and 8.5 before 8.5.5.4 does not properly handle HTTP headers, which allows remote attackers to obtain sensitive cookie and authentication data via an unspecified HTTP method. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg1PI08268 - http://www-01.ibm.com/support/docview.wss?uid=swg21684612 - https://exchange.xforce.ibmcloud.com/vulnerabilities/93059
CVE ID: CVE-2014-3022 State: PUBLISHED Published: 2014-08-22T01:00:00 Last Updated: 2024-08-06T10:28:46.372Z Vendors: n/a Products: n/a Problem Types: n/a Description: IBM WebSphere Application Server (WAS) 7.0.x before 7.0.0.33, 8.0.x before 8.0.0.9, and 8.5.x before 8.5.5.3 allows remote attackers to obtain sensitive information via a crafted URL that triggers an error condition. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg1PI09594 - http://www-01.ibm.com/support/docview.wss?uid=swg21676092 - http://www.securityfocus.com/bid/68211 - https://exchange.xforce.ibmcloud.com/vulnerabilities/93060 - http://www-01.ibm.com/suppor
.securityfocus.com/bid/68211 - https://exchange.xforce.ibmcloud.com/vulnerabilities/93060 - http://www-01.ibm.com/support/docview.wss?uid=swg21676091 - http://www-01.ibm.com/support/docview.wss?uid=swg21681249
CVE ID: CVE-2014-3024 State: PUBLISHED Published: 2014-08-29T10:00:00 Last Updated: 2024-08-06T10:28:46.384Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in IBM Maximo Asset Management 7.1 through 7.1.1.12 and 7.5 through 7.5.0.6 and Maximo Asset Management 7.5.0 through 7.5.0.3 and 7.5.1 through 7.5.1.2 for SmartCloud Control Desk allows remote authenticated users to hijack the authentication of arbitrary users. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/93063 - http://www.securitytracker.com/id/1030781 - http://www-01.ibm.com/support/docview.wss?uid=swg21
/vulnerabilities/93063 - http://www.securitytracker.com/id/1030781 - http://www-01.ibm.com/support/docview.wss?uid=swg21679918 - http://www-01.ibm.com/support/docview.wss?uid=swg1IV56643 - http://secunia.com/advisories/60408
CVE ID: CVE-2014-3025 State: PUBLISHED Published: 2014-07-30T10:00:00 Last Updated: 2024-08-06T10:28:46.365Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in IBM Maximo Asset Management 6.2 through 6.2.8, 6.x and 7.1 through 7.1.1.2, and 7.5 through 7.5.0.6; Maximo Asset Management 7.5 through 7.5.0.3 and 7.5.1 through 7.5.1.2 for SmartCloud Control Desk; and Maximo Asset Management 6.2 through 6.2.8, 7.1 through 7.1.1.2, and 7.2 for Tivoli Asset Management for IT and certain other products allow remote authenticated users to inject arbitrary web script or HTML via unspecified input to a .jsp file under webclient/utility/. Addi
ticated users to inject arbitrary web script or HTML via unspecified input to a .jsp file under webclient/utility/. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg21678754 - http://secunia.com/advisories/59640 - https://exchange.xforce.ibmcloud.com/vulnerabilities/93064 - http://secunia.com/advisories/59570 - http://www-01.ibm.com/support/docview.wss?uid=swg1IV57241
CVE ID: CVE-2014-3026 State: PUBLISHED Published: 2014-07-29T20:00:00 Last Updated: 2024-08-06T10:28:46.379Z Vendors: n/a Products: n/a Problem Types: n/a Description: CRLF injection vulnerability in IBM Maximo Asset Management 7.5 through 7.5.0.6, and 7.5 through 7.5.0.3 and 7.5.1 through 7.5.1.2 for SmartCloud Control Desk, allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/93065 - http://secunia.com/advisories/59570 - http://www-01.ibm.com/support/docview.wss?uid=swg21678798
CVE ID: CVE-2014-3031 State: PUBLISHED Published: 2014-08-12T00:00:00 Last Updated: 2024-08-06T10:28:46.292Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in IBM Tivoli Business Service Manager 4.2.0 before 4.2.0.0 IF12 and 4.2.1 before 4.2.1.3 IF9 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/93187 - http://www-01.ibm.com/support/docview.wss?uid=swg21680658
CVE ID: CVE-2014-3032 State: PUBLISHED Published: 2015-01-17T11:00:00 Last Updated: 2024-08-06T10:28:46.289Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Web GUI in IBM Tivoli Netcool/OMNIbus 7.3.0 before 7.3.0.6, 7.3.1 before 7.3.1.7, and 7.4.0 before 7.4.0.3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg21694026 - https://exchange.xforce.ibmcloud.com/vulnerabilities/93188