Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2014-2667 State: PUBLISHED Published: 2014-11-16T01:00:00 Last Updated: 2024-08-06T10:21:36.046Z Vendors: n/a Products: n/a Problem Types: n/a Description: Race condition in the _get_masked_mode function in Lib/os.py in Python 3.2 through 3.5, when exist_ok is set to true and multiple threads are used, might allow local users to bypass intended file permissions by leveraging a separate application vulnerability before the umask has been set to the expected value. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2014/03/28/15 - http://lists.opensuse.org/opensuse-updates/2014-05/msg00008.html - https://security.gentoo.org/g
ecurity/2014/03/28/15 - http://lists.opensuse.org/opensuse-updates/2014-05/msg00008.html - https://security.gentoo.org/glsa/201503-10 - http://www.openwall.com/lists/oss-security/2014/03/30/4 - http://bugs.python.org/issue21082 - http://www.openwall.com/lists/oss-security/2014/03/29/5 - http://lists.opensuse.org/opensuse-updates/2014-05/msg00007.html - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html
CVE ID: CVE-2014-2668 State: PUBLISHED Published: 2014-03-28T16:00:00 Last Updated: 2024-08-06T10:21:36.028Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apache CouchDB 1.5.0 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via the count parameter to /_uuids. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/92161 - http://www.securityfocus.com/bid/66474 - http://secunia.com/advisories/57572 - http://lists.opensuse.org/opensuse-updates/2014-04/msg00039.html - http://www.exploit-db.com/exploits/32519 - http://www.securitytracker.com/id/1029967 - http://packetstormsecu
039.html - http://www.exploit-db.com/exploits/32519 - http://www.securitytracker.com/id/1029967 - http://packetstormsecurity.com/files/125889
CVE ID: CVE-2014-2669 State: PUBLISHED Published: 2014-03-28T17:00:00 Last Updated: 2024-08-06T10:21:35.930Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple integer overflows in contrib/hstore/hstore_io.c in PostgreSQL 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to have unspecified impact via vectors related to the (1) hstore_recv, (2) hstore_from_arrays, and (3) hstore_from_array functions in contrib/hstore/hstore_io.c; and the (4) hstoreArrayToPairs function in contrib/hstore/hstore_op.c, which triggers a buffer overflow. NOTE: this issue was SPLIT from CVE-2014-0064 because it has a different set
ore_op.c, which triggers a buffer overflow. NOTE: this issue was SPLIT from CVE-2014-0064 because it has a different set of affected versions. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2014-0221.html - http://rhn.redhat.com/errata/RHSA-2014-0469.html - https://github.com/postgres/postgres/commit/31400a673325147e1205326008e32135a78b4d8a - http://wiki.postgresql.org/wiki/20140220securityrelease - http://www.debian.org/security/2014/dsa-2864 - http://www.postgresql.org/support/security/ - http://www.postgresql.org/about/news/1506/ - http://www.debian.org/security/2014/dsa-2865
CVE ID: CVE-2014-2670 State: PUBLISHED Published: 2014-03-29T20:00:00 Last Updated: 2024-08-06T10:21:36.014Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Properties.do in ZOHO ManageEngine OpStor before build 8500 allows remote authenticated users to inject arbitrary web script or HTML via the name parameter, a different vulnerability than CVE-2014-0344. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/66499 - http://www.kb.cert.org/vuls/id/140886
CVE ID: CVE-2014-2671 State: PUBLISHED Published: 2014-03-30T10:00:00 Last Updated: 2024-08-06T10:21:36.024Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Windows Media Player (WMP) 11.0.5721.5230 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted WAV file. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/92080 - http://packetstormsecurity.com/files/125834 - http://www.exploit-db.com/exploits/32477/ - http://www.securityfocus.com/bid/66403
CVE ID: CVE-2014-2672 State: PUBLISHED Published: 2014-04-01T01:00:00 Last Updated: 2024-08-06T10:21:36.020Z Vendors: n/a Products: n/a Problem Types: n/a Description: Race condition in the ath_tx_aggr_sleep function in drivers/net/wireless/ath/ath9k/xmit.c in the Linux kernel before 3.13.7 allows remote attackers to cause a denial of service (system crash) via a large amount of network traffic that triggers certain list deletions. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.kernel.org/show_bug.cgi?id=70551 - https://github.com/torvalds/linux/commit/21f8aaee0c62708654988ce092838aa7df4d25d8 - http://www.openwall.com/lists/oss-security/2014/03/30/5 - https
/linux/commit/21f8aaee0c62708654988ce092838aa7df4d25d8 - http://www.openwall.com/lists/oss-security/2014/03/30/5 - https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.15 - http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.7 - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=21f8aaee0c62708654988ce092838aa7df4d25d8 - http://www.securityfocus.com/bid/66492 - http://secunia.com/advisories/57468
CVE ID: CVE-2014-2673 State: PUBLISHED Published: 2014-04-01T01:00:00 Last Updated: 2024-08-06T10:21:35.975Z Vendors: n/a Products: n/a Problem Types: n/a Description: The arch_dup_task_struct function in the Transactional Memory (TM) implementation in arch/powerpc/kernel/process.c in the Linux kernel before 3.13.7 on the powerpc platform does not properly interact with the clone and fork system calls, which allows local users to cause a denial of service (Program Check and system crash) via certain instructions that are executed with the processor in the Transactional state. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/57436 - https://exchan
e. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/57436 - https://exchange.xforce.ibmcloud.com/vulnerabilities/92113 - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=621b5060e823301d0cba4cb52a7ee3491922d291 - http://www.securityfocus.com/bid/66477 - http://www.openwall.com/lists/oss-security/2014/03/30/5 - https://github.com/torvalds/linux/commit/621b5060e823301d0cba4cb52a7ee3491922d291 - https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.15 - http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.7
CVE ID: CVE-2014-2674 State: PUBLISHED Published: 2018-03-19T21:00:00 Last Updated: 2024-08-06T10:21:36.011Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the Ajax Pagination (twitter Style) plugin 1.1 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the loop parameter in an ajax_navigation action to wp-admin/admin-ajax.php. Additional Analyst Notes: - CVE Program Container: References: - https://security.dxw.com/advisories/end-user-exploitable-local-file-inclusion-vulnerability-in-ajax-pagination-twitter-style-1-1/
CVE ID: CVE-2014-2675 State: PUBLISHED Published: 2018-03-19T21:00:00 Last Updated: 2024-08-06T10:21:35.874Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in inc/AdminPage.php in the WP HTML Sitemap plugin 1.2 for WordPress allows remote attackers to hijack the authentication of administrators for requests that delete the sitemap via a request to the wp-html-sitemap page in wp-admin/options-general.php. Additional Analyst Notes: - CVE Program Container: References: - https://security.dxw.com/advisories/csrf-vulnerability-in-wp-html-sitemap-1-2/
CVE ID: CVE-2014-2678 State: PUBLISHED Published: 2014-04-01T01:00:00 Last Updated: 2024-08-06T10:21:36.016Z Vendors: n/a Products: n/a Problem Types: n/a Description: The rds_iw_laddr_check function in net/rds/iw.c in the Linux kernel through 3.14 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a bind system call for an RDS socket on a system that lacks RDS transports. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/60471 - http://www.securityfocus.com/bid/66543 - http://linux.oracle.com/errata/ELSA-2014-0926.html - https://lkml.org/lkml/2014/3/29/188 - ht
urityfocus.com/bid/66543 - http://linux.oracle.com/errata/ELSA-2014-0926.html - https://lkml.org/lkml/2014/3/29/188 - http://linux.oracle.com/errata/ELSA-2014-0926-1.html - http://www.openwall.com/lists/oss-security/2014/03/31/10 - http://secunia.com/advisories/59386 - http://secunia.com/advisories/60130 - http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131276.html
CVE ID: CVE-2014-2680 State: PUBLISHED Published: 2020-01-21T18:23:57 Last Updated: 2024-08-06T10:21:36.065Z Vendors: n/a Products: n/a Problem Types: n/a Description: The update process in Xmind 3.4.1 and earlier allow remote attackers to execute arbitrary code via a man-in-the-middle attack. Additional Analyst Notes: - CVE Program Container: References: - https://web.archive.org/web/20160822124252/http://rampartssecurity.com/docs/Xmind-MITM.pdf
CVE ID: CVE-2014-2681 State: PUBLISHED Published: 2014-11-16T00:00:00 Last Updated: 2024-08-06T10:21:36.060Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendService_Api before 1.0.0 allow remote attackers to read arbitrary files, send HTTP requests to intranet servers, and possibly cause a denial of service (CPU and memory consumption) via an XML External Entity (XXE) attack. NOTE: this iss
possibly cause a denial of service (CPU and memory consumption) via an XML External Entity (XXE) attack. NOTE: this issue exists because of an incomplete fix for CVE-2012-5657. Additional Analyst Notes: - CVE Program Container: References: - http://www.mandriva.com/security/advisories?name=MDVSA-2014:072 - http://advisories.mageia.org/MGASA-2014-0151.html - http://www.securityfocus.com/bid/66358 - http://www.debian.org/security/2015/dsa-3265 - http://framework.zend.com/security/advisory/ZF2014-01 - http://seclists.org/oss-sec/2014/q2/0
CVE ID: CVE-2014-2682 State: PUBLISHED Published: 2014-11-16T00:00:00 Last Updated: 2024-08-06T10:21:36.052Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendService_Api before 1.0.0, when PHP-FPM is used, does not properly share the libxml_disable_entity_loader setting between threads, which might allow remote attackers to conduct XML External Entity (XXE) attacks via an XML external entity
ween threads, which might allow remote attackers to conduct XML External Entity (XXE) attacks via an XML external entity declaration in conjunction with an entity reference. NOTE: this issue exists because of an incomplete fix for CVE-2012-5657. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/oss-sec/2014/q2/0 - http://www.mandriva.com/security/advisories?name=MDVSA-2014:072 - http://advisories.mageia.org/MGASA-2014-0151.html - http://www.securityfocus.com/bid/66358 - http://www.debian.org/security/2015/dsa-3265 - http://framework.zend.com/security/advisory/ZF2014-01
CVE ID: CVE-2014-2683 State: PUBLISHED Published: 2014-11-16T00:00:00 Last Updated: 2024-08-06T10:21:36.135Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendService_Api before 1.0.0 allow remote attackers to cause a denial of service (CPU consumption) via (1) recursive or (2) circular references in an XML entity definition in an XML DOCTYPE declaration, aka an XML Entity Expansion (XEE) att
(2) circular references in an XML entity definition in an XML DOCTYPE declaration, aka an XML Entity Expansion (XEE) attack. NOTE: this issue exists because of an incomplete fix for CVE-2012-6532. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/oss-sec/2014/q2/0 - http://www.mandriva.com/security/advisories?name=MDVSA-2014:072 - http://advisories.mageia.org/MGASA-2014-0151.html - http://www.securityfocus.com/bid/66358 - http://www.debian.org/security/2015/dsa-3265 - http://framework.zend.com/security/advisory/ZF2014-01
CVE ID: CVE-2014-2684 State: PUBLISHED Published: 2014-11-16T00:00:00 Last Updated: 2024-08-06T10:21:36.004Z Vendors: n/a Products: n/a Problem Types: n/a Description: The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend_OpenId_Consumer class in Zend Framework 1 before 1.12.4 does not verify that the openid_op_endpoint value identifies the same Identity Provider as the provider used in the association handle, which allows remote attackers to bypass authentication and spoof arbitrary OpenID identities by using a malicious OpenID Provider that generates OpenID tokens with arbitrary identifier and claimed_id values. Additional Analyst Notes: - CVE Program
r that generates OpenID tokens with arbitrary identifier and claimed_id values. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/oss-sec/2014/q2/0 - http://www.mandriva.com/security/advisories?name=MDVSA-2014:072 - http://advisories.mageia.org/MGASA-2014-0151.html - http://www.securityfocus.com/bid/66358 - http://www.debian.org/security/2015/dsa-3265 - http://framework.zend.com/security/advisory/ZF2014-02
CVE ID: CVE-2014-2685 State: PUBLISHED Published: 2014-09-04T17:00:00 Last Updated: 2024-08-06T10:21:36.026Z Vendors: n/a Products: n/a Problem Types: n/a Description: The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend_OpenId_Consumer class in Zend Framework 1 before 1.12.4 violate the OpenID 2.0 protocol by ensuring only that at least one field is signed, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/oss-sec/2014/q2/0 - http://www.mandriva.com/security/advisories?name=MDVSA-2014:072 - http://advisories.mage
eclists.org/oss-sec/2014/q2/0 - http://www.mandriva.com/security/advisories?name=MDVSA-2014:072 - http://advisories.mageia.org/MGASA-2014-0151.html - http://www.securityfocus.com/bid/66358 - http://www.debian.org/security/2015/dsa-3265 - http://framework.zend.com/security/advisory/ZF2014-02
CVE ID: CVE-2014-2686 State: PUBLISHED Published: 2020-01-09T12:25:30 Last Updated: 2024-08-06T10:21:35.996Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ansible prior to 1.5.4 mishandles the evaluation of some strings. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/forum/#%21searchin/ansible-project/1.5.4/ansible-project/MUQxiKwSQDc/id6aVaawVboJ
CVE ID: CVE-2014-2689 State: PUBLISHED Published: 2014-05-08T14:00:00 Last Updated: 2024-08-06T10:21:35.990Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Offiria 2.1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to installer/index.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/532048/100/0/threaded - http://www.securityfocus.com/bid/66657 - https://www.htbridge.com/advisory/HTB23210
CVE ID: CVE-2014-2690 State: PUBLISHED Published: 2014-04-15T14:00:00 Last Updated: 2024-08-06T10:21:36.056Z Vendors: n/a Products: n/a Problem Types: n/a Description: Citrix VDI-in-a-Box 5.3.x before 5.3.6 and 5.4.x before 5.4.3 allows local users to obtain administrator credentials by reading the log. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1030068 - http://support.citrix.com/article/CTX140106 - http://secunia.com/advisories/57734
CVE ID: CVE-2014-2706 State: PUBLISHED Published: 2014-04-14T23:00:00 Last Updated: 2024-08-06T10:21:36.015Z Vendors: n/a Products: n/a Problem Types: n/a Description: Race condition in the mac80211 subsystem in the Linux kernel before 3.13.7 allows remote attackers to cause a denial of service (system crash) via network traffic that improperly interacts with the WLAN_STA_PS_STA state (aka power-save mode), related to sta_info.c and tx.c. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00006.html - https://source.android.com/security/bulletin/2017-04-01 - http://linux.oracle.com/errata/ELSA-2014-3052.html - http
ml - https://source.android.com/security/bulletin/2017-04-01 - http://linux.oracle.com/errata/ELSA-2014-3052.html - https://bugzilla.redhat.com/show_bug.cgi?id=1083512 - http://secunia.com/advisories/60613 - https://bugzilla.kernel.org/show_bug.cgi?id=70551#c18 - http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00007.html - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=1d147bfa64293b2723c4fec50922168658e613ba - http://www.openwall.com/lists/oss-security/2014/04/01/8 - http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.7 - https://github.com/torvalds/linux/commit/1d147bfa64293b2723c4fec50922168658e613ba - http://www.securityfocus.com/bi
.7 - https://github.com/torvalds/linux/commit/1d147bfa64293b2723c4fec50922168658e613ba - http://www.securityfocus.com/bid/66591 - http://www.securitytracker.com/id/1038201
CVE ID: CVE-2014-2707 State: PUBLISHED Published: 2014-04-17T14:00:00 Last Updated: 2024-08-06T10:21:35.986Z Vendors: n/a Products: n/a Problem Types: n/a Description: cups-browsed in cups-filters 1.0.41 before 1.0.51 allows remote IPP printers to execute arbitrary commands via shell metacharacters in the (1) model or (2) PDL, related to "System V interface scripts generated for queues." Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/57530 - http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7188#NEWS - http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131485.html - http://seclists.org/oss-sec/2014/q
- http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131485.html - http://seclists.org/oss-sec/2014/q2/13 - http://www.ubuntu.com/usn/USN-2210-1 - https://bugzilla.redhat.com/show_bug.cgi?id=1083326
CVE ID: CVE-2014-2708 State: PUBLISHED Published: 2014-04-10T14:00:00 Last Updated: 2024-08-06T10:21:36.026Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in graph_xport.php in Cacti 0.8.7g, 0.8.8b, and earlier allow remote attackers to execute arbitrary SQL commands via the (1) graph_start, (2) graph_end, (3) graph_height, (4) graph_width, (5) graph_nolegend, (6) print_source, (7) local_graph_id, or (8) rra_id parameter. Additional Analyst Notes: - CVE Program Container: References: - http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131821.html - http://bugs.cacti.net/view.php?id=2405 - https://exchange.xforce.ibmcloud.
ail/package-announce/2014-April/131821.html - http://bugs.cacti.net/view.php?id=2405 - https://exchange.xforce.ibmcloud.com/vulnerabilities/92278 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742768 - http://www.securityfocus.com/bid/66555 - http://svn.cacti.net/viewvc?view=rev&revision=7439 - http://secunia.com/advisories/59203 - http://seclists.org/oss-sec/2014/q2/2 - http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131842.html - http://seclists.org/oss-sec/2014/q2/15 - http://secunia.com/advisories/57647 - http://www.debian.org/security/2014/dsa-2970 - https://bugzilla.redhat.com/show_bug.cgi?id=1084258 - https://security.gentoo.org/glsa/201509-03
CVE ID: CVE-2014-2709 State: PUBLISHED Published: 2014-04-23T14:00:00 Last Updated: 2024-08-06T10:21:36.027Z Vendors: n/a Products: n/a Problem Types: n/a Description: lib/rrd.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified parameters. Additional Analyst Notes: - CVE Program Container: References: - http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131821.html - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742768 - http://www.securityfocus.com/bid/66630 - http://svn.cacti.net/viewvc?view=rev&revision=7439 - http://secunia.com/advisories/59203 - http://lists.fedoraproject.org/piperma
n.cacti.net/viewvc?view=rev&revision=7439 - http://secunia.com/advisories/59203 - http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131842.html - http://seclists.org/oss-sec/2014/q2/15 - http://secunia.com/advisories/57647 - http://www.debian.org/security/2014/dsa-2970 - https://security.gentoo.org/glsa/201509-03
CVE ID: CVE-2014-2710 State: PUBLISHED Published: 2017-04-13T14:00:00 Last Updated: 2024-08-06T10:21:36.028Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Oliver (formerly Webshare) 1.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the (1) login page (index.php) or (2) login form (loginform-inc.php). Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2016/Apr/66 - http://www.securityfocus.com/archive/1/538132/100/0/threaded - http://packetstormsecurity.com/files/136731/Oliver-1.3.0-1.3.1-Cross-Site-Scripting.html
CVE ID: CVE-2014-2711 State: PUBLISHED Published: 2014-04-14T15:00:00 Last Updated: 2024-08-06T10:21:36.027Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in J-Web in Juniper Junos before 11.4R11, 11.4X27 before 11.4X27.62 (BBE), 12.1 before 12.1R9, 12.1X44 before 12.1X44-D35, 12.1X45 before 12.1X45-D25, 12.1X46 before 12.1X46-D20, 12.2 before 12.2R7, 12.3 before 12.3R6, 13.1 before 13.1R4, 13.2 before 13.2R3, and 13.3 before 13.3R1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://kb.juniper.net/InfoCenter/index?page=content&id=J
dditional Analyst Notes: - CVE Program Container: References: - http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10619 - http://www.securityfocus.com/bid/66770 - http://www.securitytracker.com/id/1030061
CVE ID: CVE-2014-2712 State: PUBLISHED Published: 2014-04-14T15:00:00 Last Updated: 2024-08-06T10:21:35.959Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in J-Web in Juniper Junos before 10.0S25, 10.4 before 10.4R10, 11.4 before 11.4R11, 12.1 before 12.1R9, 12.1X44 before 12.1X44-D30, 12.1X45 before 12.1X45-D20, 12.1X46 before 12.1X46-D10, and 12.2 before 12.2R1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters to index.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1030058 - http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10521 - h