Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2014-9515 State: PUBLISHED Published: 2017-12-29T22:00:00 Last Updated: 2024-08-22T14:44:13.839Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dozer improperly uses a reflection-based approach to type conversion, which might allow remote attackers to execute arbitrary code via a crafted serialized object. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securityfocus.com/bid/107970 - https://infocon.org/cons/SyScan/SyScan%202015%20Singapore/SyScan%202015%20Singapore%20presentations/SyScan15%20David%20Jorm%20-%20Finding%20and%20exploiting%20novel%20flaws%20in%20Java%20software.pdf - https://github.com/DozerMapper/doz
%20Jorm%20-%20Finding%20and%20exploiting%20novel%20flaws%20in%20Java%20software.pdf - https://github.com/DozerMapper/dozer/issues/217 - https://github.com/pentestingforfunandprofit/research/tree/master/dozer-rce - https://github.com/DozerMapper/dozer/issues/410 - https://github.com/DozerMapper/dozer/issues/786 - https://github.com/DozerMapper/dozer/pull/447/commits/ccd550696f3df8545319ffa9c6adafc8eca2334c - https://www.oracle.com/security-alerts/cpuApr2021.html - https://security.netapp.com/advisory/ntap-20240719-0002/
CVE ID: CVE-2014-9516 State: PUBLISHED Published: 2015-01-05T20:00:00Z Last Updated: 2024-09-17T04:04:01.196Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Social Microblogging PRO 1.5 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the default URI, related to the "Web Site" input in the Profile section. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/show/osvdb/116553 - http://www.exploit-db.com/exploits/35659
CVE ID: CVE-2014-9517 State: PUBLISHED Published: 2015-01-05T20:00:00 Last Updated: 2024-08-06T13:47:41.363Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in D-link IP camera DCS-2103 with firmware before 1.20 allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING to vb.htm. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2014/Dec/85 - http://websecurity.com.ua/7288/ - http://packetstormsecurity.com/files/129609/D-Link-DCS-2103-Brute-Force-Cross-Site-Scripting.html
CVE ID: CVE-2014-9518 State: PUBLISHED Published: 2015-01-05T20:00:00Z Last Updated: 2024-09-16T17:58:51.791Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in login.cgi in D-Link router DIR-655 (rev Bx) with firmware before 2.12b01 allows remote attackers to inject arbitrary web script or HTML via the html_response_page parameter. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/61831 - http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10048 - http://www.securityfocus.com/bid/71772
CVE ID: CVE-2014-9519 State: PUBLISHED Published: 2015-01-05T20:00:00Z Last Updated: 2024-09-16T22:15:56.445Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in login.php in InfiniteWP Admin Panel before 2.4.3 allows remote attackers to execute arbitrary SQL commands via the email parameter. Additional Analyst Notes: - CVE Program Container: References: - https://lifeforms.nl/20141210/infinitewp-vulnerabilities/ - http://seclists.org/fulldisclosure/2014/Dec/43
CVE ID: CVE-2014-9520 State: PUBLISHED Published: 2015-01-05T20:00:00Z Last Updated: 2024-09-17T02:27:14.139Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in execute.php in InfiniteWP Admin Panel before 2.4.4 allows remote attackers to execute arbitrary SQL commands via the historyID parameter. Additional Analyst Notes: - CVE Program Container: References: - https://lifeforms.nl/20141210/infinitewp-vulnerabilities/ - http://seclists.org/fulldisclosure/2014/Dec/43
CVE ID: CVE-2014-9521 State: PUBLISHED Published: 2015-01-05T20:00:00Z Last Updated: 2024-09-16T23:11:01.143Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted file upload vulnerability in uploadScript.php in InfiniteWP Admin Panel before 2.4.4, when the allWPFiles query parameter is set, allows remote attackers to execute arbitrary code by uploading a file with a double extension, then accessing it via a direct request to the file in the uploads directory, as demonstrated by the .php.swp filename. Additional Analyst Notes: - CVE Program Container: References: - https://lifeforms.nl/20141210/infinitewp-vulnerabilities/ - http://seclists.org/fulldisclosure/2014/Dec/43
CVE ID: CVE-2014-9522 State: PUBLISHED Published: 2015-01-05T20:00:00 Last Updated: 2024-08-06T13:47:41.263Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in CMS Papoo Light 6.0.0 (Rev 4701) allow remote attackers to inject arbitrary web script or HTML via the (1) author field to guestbook.php or (2) username field to account.php. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/show/osvdb/115944 - http://packetstormsecurity.com/files/129586/CMS-Papoo-6.0.0-Revision-4701-Cross-Site-Scripting.html - http://sroesemann.blogspot.de/2014/12/bericht-zu-advisory-sroeadv-2014-01.html - http://www.securi
Site-Scripting.html - http://sroesemann.blogspot.de/2014/12/bericht-zu-advisory-sroeadv-2014-01.html - http://www.securityfocus.com/archive/1/534243/100/0/threaded - http://www.exploit-db.com/exploits/35551 - http://www.securityfocus.com/bid/71676
CVE ID: CVE-2014-9523 State: PUBLISHED Published: 2015-01-05T20:00:00Z Last Updated: 2024-09-16T23:30:37.264Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Our Team Showcase (our-team-enhanced) plugin before 1.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings via unspecified vectors or (2) conduct cross-site scripting (XSS) attacks via the sc_our_team_member_count parameter in the sc_team_settings page to wp-admin/edit.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/129499/Wor
it.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/129499/WordPress-Our-Team-Showcase-1.2-CSRF-XSS.html
CVE ID: CVE-2014-9524 State: PUBLISHED Published: 2015-01-05T20:00:00Z Last Updated: 2024-09-17T01:26:38.071Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Facebook Like Box (cardoza-facebook-like-box) plugin before 2.8.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings via unspecified vectors or conduct cross-site scripting (XSS) attacks via the (2) frm_title, (3) frm_url, (4) frm_border_color, (5) frm_width, or (6) frm_height parameter in the slug_for_fb_like_box page to wp-admin/admin.php. Additional Analyst Notes: - CVE Program Con
frm_height parameter in the slug_for_fb_like_box page to wp-admin/admin.php. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/cardoza-facebook-like-box/changelog/ - http://secunia.com/advisories/61557 - http://packetstormsecurity.com/files/129506/WordPress-Facebook-Like-Box-2.8.2-CSRF-XSS.html
CVE ID: CVE-2014-9525 State: PUBLISHED Published: 2015-01-05T20:00:00 Last Updated: 2024-08-06T13:47:41.717Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Timed Popup (wp-timed-popup) plugin 1.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings via unspecified vectors or (2) conduct cross-site scripting (XSS) attacks via the sc_popup_subtitle parameter in the wp-popup.php page to wp-admin/options-general.php. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/99377 - htt
l Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/99377 - https://exchange.xforce.ibmcloud.com/vulnerabilities/99376 - http://packetstormsecurity.com/files/129510/WordPress-Timed-Popup-1.3-CSRF-XSS.html
CVE ID: CVE-2014-9526 State: PUBLISHED Published: 2015-01-05T21:00:00 Last Updated: 2024-08-06T13:47:41.379Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in concrete5 5.7.2.1, 5.7.2, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) gName parameter in single_pages/dashboard/users/groups/bulkupdate.php or (2) instance_id parameter in tools/dashboard/sitemap_drag_request.php. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/99264 - http://www.securityfocus.com/archive/1/534189/100/0/threaded - http://morxploit.com/morxploits/
/vulnerabilities/99264 - http://www.securityfocus.com/archive/1/534189/100/0/threaded - http://morxploit.com/morxploits/morxconxss.txt - http://packetstormsecurity.com/files/129446/Concrete5-CMS-5.7.2-5.7.2.1-Cross-Site-Scripting.html - http://seclists.org/fulldisclosure/2014/Dec/38
CVE ID: CVE-2014-9527 State: PUBLISHED Published: 2015-01-06T15:00:00 Last Updated: 2024-08-06T13:47:41.391Z Vendors: n/a Products: n/a Problem Types: n/a Description: HSLFSlideShow in Apache POI before 3.11 allows remote attackers to cause a denial of service (infinite loop and deadlock) via a crafted PPT file. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg21996759 - https://access.redhat.com/errata/RHSA-2016:1135 - http://poi.apache.org/changes.html - http://www.securityfocus.com/bid/77726 - http://secunia.com/advisories/61953 - http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150228.html - https://i
a.com/advisories/61953 - http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150228.html - https://issues.apache.org/bugzilla/show_bug.cgi?id=57272
CVE ID: CVE-2014-9528 State: PUBLISHED Published: 2015-01-06T15:00:00 Last Updated: 2024-08-06T13:47:41.494Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the actionIndex function in protected/modules_core/notification/controllers/ListController.php in HumHub 0.10.0-rc.1 and earlier allows remote authenticated users to execute arbitrary SQL commands via the from parameter to index.php. NOTE: this can be leveraged for cross-site scripting (XSS) attacks via a request that causes an error. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/129440/Humhub-0.10.0-rc.1-Cross-Site-Scripting-SQL-Injection.h
ainer: References: - http://packetstormsecurity.com/files/129440/Humhub-0.10.0-rc.1-Cross-Site-Scripting-SQL-Injection.html - https://github.com/humhub/humhub/commit/febb89ab823d0bd6246c6cf460addabb6d7a01d4 - http://www.exploit-db.com/exploits/35510 - http://seclists.org/fulldisclosure/2014/Dec/31 - https://exchange.xforce.ibmcloud.com/vulnerabilities/99272
CVE ID: CVE-2014-9529 State: PUBLISHED Published: 2015-01-09T21:00:00 Last Updated: 2024-08-06T13:47:41.340Z Vendors: n/a Products: n/a Problem Types: n/a Description: Race condition in the key_gc_unused_keys function in security/keys/gc.c in the Linux kernel through 3.18.2 allows local users to cause a denial of service (memory corruption or panic) or possibly have unspecified other impact via keyctl commands that trigger access to a key structure member during garbage collection of a key. Additional Analyst Notes: - CVE Program Container: References: - http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147864.html - http://www.ubuntu.com/usn/USN-2515-1 - https://exchang
project.org/pipermail/package-announce/2015-January/147864.html - http://www.ubuntu.com/usn/USN-2515-1 - https://exchange.xforce.ibmcloud.com/vulnerabilities/99641 - http://www.openwall.com/lists/oss-security/2015/01/06/10 - http://www.ubuntu.com/usn/USN-2512-1 - http://www.ubuntu.com/usn/USN-2514-1 - http://rhn.redhat.com/errata/RHSA-2015-1138.html - http://www.ubuntu.com/usn/USN-2518-1 - http://rhn.redhat.com/errata/RHSA-2015-0864.html - https://bugzilla.redhat.com/show_bug.cgi?id=1179813 - http://www.mandriva.com/security/advisories?name=MDVSA-2015:058 - http://www.securityfocus.com/bid/71880 - http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147973.html - http://www
ityfocus.com/bid/71880 - http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147973.html - http://www.securitytracker.com/id/1036763 - https://github.com/torvalds/linux/commit/a3a8784454692dd72e5d5d34dcdab17b4420e74c - http://www.ubuntu.com/usn/USN-2517-1 - http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00009.html - http://www.debian.org/security/2015/dsa-3128 - http://www.ubuntu.com/usn/USN-2516-1 - http://rhn.redhat.com/errata/RHSA-2015-1137.html - http://www.ubuntu.com/usn/USN-2513-1 - http://www.ubuntu.com/usn/USN-2511-1 - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=a3a8784454692dd72e5d5d34dcdab17b4420e74c
CVE ID: CVE-2014-9530 State: PUBLISHED Published: 2020-02-07T14:58:26 Last Updated: 2024-08-06T13:47:41.421Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability exists in nw.js before 0.11.3 when calling nw methods from normal frames, which has an unspecified impact. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nwjs/nw.js/blob/master/CHANGELOG.md
CVE ID: CVE-2014-9556 State: PUBLISHED Published: 2015-02-03T16:00:00 Last Updated: 2024-08-06T13:47:41.409Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow in the qtmd_decompress function in libmspack 0.4 allows remote attackers to cause a denial of service (hang) via a crafted CAB file, which triggers an infinite loop. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2015/01/01/5 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=773041 - http://secunia.com/advisories/62793 - http://advisories.mageia.org/MGASA-2015-0052.html - http://www.openwall.com/lists/oss-security/2015/01/07/2 - http://lists.opensu
visories.mageia.org/MGASA-2015-0052.html - http://www.openwall.com/lists/oss-security/2015/01/07/2 - http://lists.opensuse.org/opensuse-updates/2015-02/msg00004.html - http://www.mandriva.com/security/advisories?name=MDVSA-2015:041
CVE ID: CVE-2014-9557 State: PUBLISHED Published: 2017-08-28T15:00:00 Last Updated: 2024-08-06T13:47:41.284Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in SmartCMS v.2. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2015/Jan/97 - http://packetstormsecurity.com/files/130076/SmartCMS-2-Cross-Site-Scripting.html
CVE ID: CVE-2014-9558 State: PUBLISHED Published: 2017-08-28T15:00:00 Last Updated: 2024-08-06T13:47:41.407Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in SmartCMS v.2. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2015/Jan/96 - http://packetstormsecurity.com/files/130075/SmartCMS-2-SQL-Injection.html - http://www.securityfocus.com/bid/72289
CVE ID: CVE-2014-9559 State: PUBLISHED Published: 2015-02-03T16:00:00 Last Updated: 2024-08-06T13:47:41.367Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in SnipSnap 0.5.2a, 1.0b1, and 1.0b2 allows remote attackers to inject arbitrary web script or HTML via the query parameter to /snipsnap-search. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2015/Feb/1 - http://tetraph.com/security/cves/cve-2014-9559-snipsnap-xss-cross-site-scripting-security-vulnerabilities/
CVE ID: CVE-2014-9560 State: PUBLISHED Published: 2015-01-15T15:00:00 Last Updated: 2024-08-06T13:47:41.566Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in redir_last_post_list.php in SoftBB 0.1.3 allows remote attackers to execute arbitrary SQL commands via the post parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/129888/SoftBB-0.1.3-SQL-Injection.html - http://www.securityfocus.com/bid/71986 - http://seclists.org/fulldisclosure/2015/Jan/20 - http://tetraph.com/security/cves/cve-2014-9560-softbb-net-softbb-sql-injection-security-vulnerability/
CVE ID: CVE-2014-9561 State: PUBLISHED Published: 2015-01-15T15:00:00 Last Updated: 2024-08-06T13:47:41.640Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in redir_last_post_list.php in SoftBB 0.1.3 allows remote attackers to inject arbitrary web script or HTML via the post parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/71987 - http://seclists.org/fulldisclosure/2015/Jan/21 - http://packetstormsecurity.com/files/129889/SoftBB-0.1.3-Cross-Site-Scripting.html - http://tetraph.com/security/cves/cve-2014-9561-softbb-net-softbb-xss-cross-site-scripting-security-vulnerability/
CVE ID: CVE-2014-9562 State: PUBLISHED Published: 2015-02-04T18:00:00 Last Updated: 2024-08-06T13:47:41.720Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in display_dialog.php in M2 OptimalSite 0.1 and 2.4 allows remote attackers to inject arbitrary web script or HTML via the image parameter. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2015/Feb/8 - http://tetraph.com/security/cves/cve-2014-9562-optimalsite-content-management-system-cms-xss-cross-site-scripting-security-vulnerabilities/
CVE ID: CVE-2014-9563 State: PUBLISHED Published: 2018-04-12T21:00:00 Last Updated: 2024-08-06T13:47:41.671Z Vendors: n/a Products: n/a Problem Types: n/a Description: CRLF injection vulnerability in the web-based management (WBM) interface in Unify (former Siemens) OpenStage SIP and OpenScape Desk Phone IP V3 devices before R3.32.0 allows remote authenticated users to modify the root password and consequently access the debug port using the serial interface via the ssh-password parameter to page.cmd. Additional Analyst Notes: - CVE Program Container: References: - https://networks.unify.com/security/advisories/OBSO-1501-02.pdf - https://www.modzero.ch/advisories/MZ-14-02-Siemens-Unify-OpenS
networks.unify.com/security/advisories/OBSO-1501-02.pdf - https://www.modzero.ch/advisories/MZ-14-02-Siemens-Unify-OpenStage.txt
CVE ID: CVE-2014-9564 State: PUBLISHED Published: 2017-08-25T18:00:00 Last Updated: 2024-08-06T13:47:41.631Z Vendors: n/a Products: n/a Problem Types: n/a Description: CRLF injection vulnerability in IBM Flex System EN6131 40Gb Ethernet and IB6131 40Gb Infiniband Switch firmware before 3.4.1110 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks and resulting web cache poisoning or cross-site scripting (XSS) attacks, or obtain sensitive information via multiple unspecified parameters. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/home/docdisplay?lndocid=MIGR-5098173 - http://www.securityfocus.com/
ontainer: References: - https://www.ibm.com/support/home/docdisplay?lndocid=MIGR-5098173 - http://www.securityfocus.com/bid/74931
CVE ID: CVE-2014-9565 State: PUBLISHED Published: 2017-09-07T20:00:00 Last Updated: 2024-08-06T13:47:41.807Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in IBM Flex System EN6131 40Gb Ethernet and IB6131 40Gb Infiniband Switch firmware 3.4.0000 and earlier. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/74930 - https://support.podc.sl.edst.ibm.com/support/home/docdisplay?lndocid=MIGR-5098173
CVE ID: CVE-2014-9566 State: PUBLISHED Published: 2015-03-10T14:00:00 Last Updated: 2024-08-06T13:47:41.774Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwinds Orion Platform 2015.1, as used in Network Performance Monitor (NPM) before 11.5, NetFlow Traffic Analyzer (NTA) before 4.1, Network Configuration Manager (NCM) before 7.3.2, IP Address Manager (IPAM) before 4.3, User Device Tracker (UDT) before 3.2, VoIP & Network Quality Manager (VNQM) before 4.2, Server & Application Manager (SAM) before 6.2, Web Performance Monitor (WPM) before 2.2, and possibly other S
efore 4.2, Server & Application Manager (SAM) before 6.2, Web Performance Monitor (WPM) before 2.2, and possibly other Solarwinds products, allow remote authenticated users to execute arbitrary SQL commands via the (1) dir or (2) sort parameter to the (a) GetAccounts or (b) GetAccountGroups endpoint. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rapid7/metasploit-framework/pull/4836 - http://www.exploit-db.com/exploits/36262 - http://osvdb.org/show/osvdb/118746 - http://volatile-minds.blogspot.com/2015/02/authenticated-stacked-sql-injection-in.html - http://seclists.org/fulldisclosure/2015/Mar/18 - http://packetstormsecurity.com/files/130637/Solarwinds-O
tion-in.html - http://seclists.org/fulldisclosure/2015/Mar/18 - http://packetstormsecurity.com/files/130637/Solarwinds-Orion-Service-SQL-Injection.html - http://www.solarwinds.com/documentation/orion/docs/releasenotes/releasenotes.htm
CVE ID: CVE-2014-9567 State: PUBLISHED Published: 2015-01-07T18:00:00 Last Updated: 2024-08-06T13:47:41.739Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted file upload vulnerability in process-upload.php in ProjectSend (formerly cFTP) r100 through r561 allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in the upload/files/ or upload/temp/ directory. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/35424 - http://packetstormsecurity.com/files/129759/ProjectSend-Arbitrary-File-Upload.html - http://www.exploit-db.com/exploits
http://packetstormsecurity.com/files/129759/ProjectSend-Arbitrary-File-Upload.html - http://www.exploit-db.com/exploits/35660 - http://osvdb.org/show/osvdb/116469 - https://exchange.xforce.ibmcloud.com/vulnerabilities/99548
CVE ID: CVE-2014-9568 State: PUBLISHED Published: 2015-02-03T16:00:00 Last Updated: 2024-08-06T13:47:41.818Z Vendors: n/a Products: n/a Problem Types: n/a Description: puppetlabs-rabbitmq 3.0 through 4.1 stores the RabbitMQ Erlang cookie value in the facts of a node, which allows local users to obtain sensitive information as demonstrated by using Facter. Additional Analyst Notes: - CVE Program Container: References: - http://puppetlabs.com/security/cve/cve-2014-9568
CVE ID: CVE-2014-9569 State: PUBLISHED Published: 2015-01-07T19:00:00 Last Updated: 2024-08-06T13:47:41.660Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in SAP NetWeaver Business Client (NWBC) for HTML 3.0 allow remote attackers to inject arbitrary web script or HTML via the (1) title or (2) roundtrips parameter, aka SAP Security Note 2051285. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/62017 - http://www.senseofsecurity.com.au/advisories/SOS-14-005 - http://www.securitytracker.com/id/1031509