Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2014-8735 State: PUBLISHED Published: 2014-11-12T16:00:00Z Last Updated: 2024-09-17T00:31:44.047Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Bad Behavior module 6.x-2.x before 6.x-2.2216 and 7.x-2.x before 7.x-2.2216 for Drupal logs usernames and passwords, which allows remote authenticated users with the "administer bad behavior" permission to obtain sensitive information by reading a log file. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/node/2360955 - https://www.drupal.org/node/2360953 - https://www.drupal.org/node/2361611
CVE ID: CVE-2014-8736 State: PUBLISHED Published: 2014-11-12T16:00:00Z Last Updated: 2024-09-17T02:32:38.828Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Open Atrium Core module for Drupal before 7.x-2.22 allows remote attackers to bypass access restrictions and read file attachments that have been removed from a node by leveraging a previous revision of the node. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/node/2357295 - https://www.drupal.org/node/2357279
CVE ID: CVE-2014-8737 State: PUBLISHED Published: 2014-12-09T22:52:00 Last Updated: 2024-08-06T13:26:02.580Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple directory traversal vulnerabilities in GNU binutils 2.24 and earlier allow local users to delete arbitrary files via a .. (dot dot) or full path name in an archive to (1) strip or (2) objcopy or create arbitrary files via (3) a .. (dot dot) or full path name in an archive to ar. Additional Analyst Notes: - CVE Program Container: References: - http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145746.html - http://secunia.com/advisories/62241 - http://www.mandriva.com/security/advisories?name=MDVSA
2014-December/145746.html - http://secunia.com/advisories/62241 - http://www.mandriva.com/security/advisories?name=MDVSA-2015:029 - https://bugzilla.redhat.com/show_bug.cgi?id=1162655 - http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148438.html - http://www.ubuntu.com/usn/USN-2496-1 - https://sourceware.org/bugzilla/show_bug.cgi?id=17552 - http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147346.html - http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145352.html - http://www.openwall.com/lists/oss-security/2014/11/13/1 - https://sourceware.
ckage-announce/2014-December/145352.html - http://www.openwall.com/lists/oss-security/2014/11/13/1 - https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=dd9b91de2149ee81d47f708e7b0bbf57da10ad42 - http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148427.html - http://secunia.com/advisories/62746 - http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147354.html - http://www.securityfocus.com/bid/70908 - http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145256.html - https://sourceware.org/bugzilla/show_bug.cgi?id=17533 - https://security.gentoo.org/glsa/201612-24
CVE ID: CVE-2014-8738 State: PUBLISHED Published: 2015-01-15T15:00:00 Last Updated: 2024-08-06T13:26:02.477Z Vendors: n/a Products: n/a Problem Types: n/a Description: The _bfd_slurp_extended_name_table function in bfd/archive.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (invalid write, segmentation fault, and crash) via a crafted extended name table in an archive. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/62241 - http://www.openwall.com/lists/oss-security/2014/11/05/7 - http://www.mandriva.com/security/advisories?name=MDVSA-2015:029 - http://lists.fedoraproject.org/pipermail/package-announce/2015
ww.mandriva.com/security/advisories?name=MDVSA-2015:029 - http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148438.html - http://www.ubuntu.com/usn/USN-2496-1 - http://www.openwall.com/lists/oss-security/2014/11/02/4 - http://www.openwall.com/lists/oss-security/2014/11/13/2 - http://www.securityfocus.com/bid/71083 - http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147346.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148427.html - http://secunia.com/advisories/62746 - http://lists.fedoraproject.org/pipermail/package-announce/2015-Janu
/148427.html - http://secunia.com/advisories/62746 - http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147354.html - https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=bb0d867169d7e9743d229804106a8fbcab7f3b3f - https://sourceware.org/bugzilla/show_bug.cgi?id=17533 - http://www.debian.org/security/2015/dsa-3123 - https://security.gentoo.org/glsa/201612-24
CVE ID: CVE-2014-8739 State: PUBLISHED Published: 2020-02-08T17:21:54 Last Updated: 2024-08-06T13:26:02.461Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Creative Solutions Creative Contact Form (formerly Sexy Contact Form) before 1.0.0 for WordPress and before 2.0.1 for Joomla!, allows remote attackers to execute arbitrary code by uploading a PHP file with an PHP extension, then accessing it via a direct request to the file in files/, as exploited in the wild in October 2014. Additional Analyst Notes: - CVE Program Container: References: - ht
in files/, as exploited in the wild in October 2014. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/35057/ - https://www.exploit-db.com/exploits/36811/ - http://www.openwall.com/lists/oss-security/2014/11/11/4 - http://www.openwall.com/lists/oss-security/2014/11/11/5 - http://www.openwall.com/lists/oss-security/2014/11/13/3 - https://wordpress.org/plugins/sexy-contact-form/changelog/ - http://osvdb.org/show/osvdb/113669 - http://osvdb.org/show/osvdb/113673
CVE ID: CVE-2014-8741 State: PUBLISHED Published: 2020-01-27T17:29:28 Last Updated: 2024-08-06T13:26:02.571Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the GfdFileUploadServerlet servlet in Lexmark MarkVision Enterprise before 2.1 allows remote attackers to write to arbitrary files via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://support.lexmark.com/index?page=content&id=TE666 - http://www.zerodayinitiative.com/advisories/ZDI-14-410/
CVE ID: CVE-2014-8742 State: PUBLISHED Published: 2020-01-27T17:29:25 Last Updated: 2024-08-06T13:26:02.585Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the ReportDownloadServlet servlet in Lexmark MarkVision Enterprise before 2.1 allows remote attackers to read arbitrary files via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.zerodayinitiative.com/advisories/ZDI-14-411/ - http://support.lexmark.com/index?page=content&id=TE666
CVE ID: CVE-2014-8743 State: PUBLISHED Published: 2014-10-13T18:00:00 Last Updated: 2024-08-06T13:26:02.590Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the Maestro module 7.x-1.x before 7.x-1.4 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via a (1) Role or (2) Organic Group name. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/node/2013653 - http://secunia.com/advisories/56790 - https://drupal.org/node/2200453 - https://exchange.xforce.ibmcloud.com/vulnerabilities/91274 - http://www.securityfocus.com/bid/65677
CVE ID: CVE-2014-8744 State: PUBLISHED Published: 2014-10-13T18:00:00 Last Updated: 2024-08-06T13:26:02.548Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Nivo Slider module 7.x-2.x before 7.x-1.11 for Drupal allows remote authenticated users with the "administer nivo slider" permission to inject arbitrary web script or HTML via an image title. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/57459 - https://exchange.xforce.ibmcloud.com/vulnerabilities/92009 - https://www.drupal.org/node/2221481 - https://www.drupal.org/node/2220545 - http://www.securityfocus.com/bid/66327
CVE ID: CVE-2014-8745 State: PUBLISHED Published: 2014-10-13T18:00:00 Last Updated: 2024-08-06T13:26:02.533Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Custom Search module 6.x-1.x before 6.x-1.13 and 7.x-1.x before 7.x-1.15 for Drupal allows remote authenticated users with the "administer taxonomy" permission to inject arbitrary web script or HTML via a taxonomy vocabulary label. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/node/2247919 - http://www.securityfocus.com/bid/67062 - https://exchange.xforce.ibmcloud.com/vulnerabilities/92754 - http://drupal.org/node/2248077 - http://secunia
bid/67062 - https://exchange.xforce.ibmcloud.com/vulnerabilities/92754 - http://drupal.org/node/2248077 - http://secunia.com/advisories/58209 - https://www.drupal.org/node/2247921
CVE ID: CVE-2014-8746 State: PUBLISHED Published: 2014-10-13T18:00:00 Last Updated: 2024-08-06T13:26:02.580Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Skeleton theme 7.x-1.2 through 7.x-1.3 before 7.x-1.4, for Drupal allows remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via vectors related to theme settings. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/57831 - https://exchange.xforce.ibmcloud.com/vulnerabilities/92529 - https://www.drupal.org/node/2236821 - https://www.drupal.org/node/2236259
CVE ID: CVE-2014-8747 State: PUBLISHED Published: 2014-10-13T18:00:00 Last Updated: 2024-08-06T13:26:02.584Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Drupal Commons module 7.x-3.x before 7.x-3.9 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors related to content creation and activity stream messages. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/node/2194777 - https://www.drupal.org/node/2194877 - http://osvdb.org/103288 - https://exchange.xforce.ibmcloud.com/vulnerabilities/91151 - http://www.securityfocus.com/bid/65524 - http://secunia.com/advisor
exchange.xforce.ibmcloud.com/vulnerabilities/91151 - http://www.securityfocus.com/bid/65524 - http://secunia.com/advisories/56861
CVE ID: CVE-2014-8748 State: PUBLISHED Published: 2014-10-13T18:00:00Z Last Updated: 2024-09-16T18:18:21.559Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Google Doubleclick for Publishers (DFP) module 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with the "administer dfp" permission to inject arbitrary web script or HTML via a slot name. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/56521 - https://www.drupal.org/node/2172167 - https://drupal.org/node/2179085 - http://osvdb.org/102354
CVE ID: CVE-2014-8749 State: PUBLISHED Published: 2014-12-01T15:00:00 Last Updated: 2024-08-06T13:26:02.503Z Vendors: n/a Products: n/a Problem Types: n/a Description: Server-side request forgery (SSRF) vulnerability in admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for WordPress allows remote attackers to trigger outbound requests that authenticate to arbitrary databases via the dbhost parameter. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2014/Nov/13 - https://wordpress.org/plugins/bulletproof-security/changelog/
CVE ID: CVE-2014-8750 State: PUBLISHED Published: 2014-10-15T14:00:00 Last Updated: 2024-08-06T13:26:02.969Z Vendors: n/a Products: n/a Problem Types: n/a Description: Race condition in the VMware driver in OpenStack Compute (Nova) before 2014.1.4 and 2014.2 before 2014.2rc1 allows remote authenticated users to access unintended consoles by spawning an instance that triggers the same VNC port to be allocated to two different instances. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/nova/+bug/1357372 - http://secunia.com/advisories/60227 - http://rhn.redhat.com/errata/RHSA-2014-1689.html - http://rhn.redhat.com/errata/RHSA-2014-1782.html - http://r
s/60227 - http://rhn.redhat.com/errata/RHSA-2014-1689.html - http://rhn.redhat.com/errata/RHSA-2014-1782.html - http://rhn.redhat.com/errata/RHSA-2014-1781.html - http://www.openwall.com/lists/oss-security/2014/10/14/9 - http://lists.openstack.org/pipermail/openstack-announce/2014-October/000293.html - http://www.securityfocus.com/bid/70182
CVE ID: CVE-2014-8751 State: PUBLISHED Published: 2014-12-16T18:00:00 Last Updated: 2024-08-06T13:26:02.497Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in goYWP WebPress 13.00.06 allow remote attackers to inject arbitrary web script or HTML via the (1) search_param parameter to search.php or (2) name, (3) address, or (4) comment parameter to forms.php. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2014/Dec/34 - http://packetstormsecurity.com/files/129443/goYWP-WebPress-13.00.06-Cross-Site-Scripting.html
CVE ID: CVE-2014-8752 State: PUBLISHED Published: 2014-12-31T21:00:00 Last Updated: 2024-08-06T13:26:02.589Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in view.php in JCE-Tech PHP Video Script (aka Video Niche Script) 4.0 allow remote attackers to inject arbitrary web script or HTML via the (1) video or (2) title parameter. Additional Analyst Notes: - CVE Program Container: References: - http://tetraph.com/security/cves/cve-2014-8752-jce-tech-video-niche-script-xss-cross-site-scripting-security-vulnerability/ - http://www.securityfocus.com/bid/71738 - http://seclists.org/fulldisclosure/2014/Dec/84
CVE ID: CVE-2014-8753 State: PUBLISHED Published: 2017-08-28T15:00:00 Last Updated: 2024-08-06T13:26:02.610Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Cit-e-Net Cit-e-Access 6. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/72614 - http://seclists.org/fulldisclosure/2015/Feb/48 - http://packetstormsecurity.com/files/130392/Cit-e-Net-6-Cross-Site-Scripting.html
CVE ID: CVE-2014-8754 State: PUBLISHED Published: 2014-12-02T16:00:00 Last Updated: 2024-08-06T13:26:02.540Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open redirect vulnerability in track-click.php in the Ad-Manager plugin 1.1.2 for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the out parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/98990 - http://packetstormsecurity.com/files/129290/WordPress-Ad-Manager-1.1.2-Open-Redirect.html - http://seclists.org/fulldisclosure/2014/Nov/93 - http://tetraph.com/security/cves/cve-2014-8754-
.2-Open-Redirect.html - http://seclists.org/fulldisclosure/2014/Nov/93 - http://tetraph.com/security/cves/cve-2014-8754-wordpress-ad-manager-plugin-dest-redirect-privilege-escalation/
CVE ID: CVE-2014-8755 State: PUBLISHED Published: 2014-10-17T15:00:00 Last Updated: 2024-08-06T13:26:02.679Z Vendors: n/a Products: n/a Problem Types: n/a Description: Panasonic Network Camera View 3 and 4 allows remote attackers to execute arbitrary code via a crafted page, which triggers an invalid pointer dereference, related to "the ability to nullify an arbitrary address in memory." Additional Analyst Notes: - CVE Program Container: References: - http://www.zerodayinitiative.com/advisories/ZDI-14-364/ - http://security.panasonic.com/pss/security/library/howto_update_NCV.html
CVE ID: CVE-2014-8756 State: PUBLISHED Published: 2014-10-17T15:00:00 Last Updated: 2024-08-06T13:26:02.654Z Vendors: n/a Products: n/a Problem Types: n/a Description: The NcrCtl4.NcrNet.1 control in Panasonic Network Camera Recorder before 4.04R03 allows remote attackers to execute arbitrary code via a crafted GetVOLHeader method call, which writes null bytes to an arbitrary address. Additional Analyst Notes: - CVE Program Container: References: - http://panasonic.net/pcc/cgi-bin/products/netwkcam/download_us/tbookmarka_m.cgi?m=%20&mm=2010073014092324 - http://www.zerodayinitiative.com/advisories/ZDI-14-363/
CVE ID: CVE-2014-8757 State: PUBLISHED Published: 2015-02-17T15:00:00 Last Updated: 2024-08-06T13:26:02.564Z Vendors: n/a Products: n/a Problem Types: n/a Description: LG On-Screen Phone (OSP) before 4.3.010 allows remote attackers to bypass authorization via a crafted request. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/72535 - http://www.securityfocus.com/bid/72544 - http://seclists.org/fulldisclosure/2015/Feb/26 - http://packetstormsecurity.com/files/130286/LG-On-Screen-Phone-Authentication-Bypass.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/100733 - http://www.securityfocus.com/archive/1/534643/100/0/threaded
CVE ID: CVE-2014-8758 State: PUBLISHED Published: 2017-10-06T14:00:00 Last Updated: 2024-08-06T13:26:02.507Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Best Gallery Albums Plugin before 3.0.70for WordPress allows remote attackers to inject arbitrary web script or HTML via the order_id parameter in the gallery_album_sorting page to wp-admin/admin.php. Additional Analyst Notes: - CVE Program Container: References: - https://g0blin.co.uk/cve-2014-8758/ - https://wpvulndb.com/vulnerabilities/8236
CVE ID: CVE-2014-8760 State: PUBLISHED Published: 2014-10-25T00:00:00 Last Updated: 2024-08-06T13:26:02.547Z Vendors: n/a Products: n/a Problem Types: n/a Description: ejabberd before 2.1.13 does not enforce the starttls_required setting when compression is used, which causes clients to establish connections without encryption. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/oss-sec/2014/q4/312 - http://mail.jabber.org/pipermail/operators/2014-October/002438.html - http://advisories.mageia.org/MGASA-2014-0417.html - https://github.com/processone/ejabberd/commit/7bdc1151b - https://bugzilla.redhat.com/show_bug.cgi?id=1153839 - http://www.mandriva.com/secur
ocessone/ejabberd/commit/7bdc1151b - https://bugzilla.redhat.com/show_bug.cgi?id=1153839 - http://www.mandriva.com/security/advisories?name=MDVSA-2014:207 - http://www.securityfocus.com/bid/70415 - http://www.mandriva.com/security/advisories?name=MDVSA-2015:175
CVE ID: CVE-2014-8761 State: PUBLISHED Published: 2014-10-22T14:00:00 Last Updated: 2024-08-06T13:26:02.511Z Vendors: n/a Products: n/a Problem Types: n/a Description: inc/template.php in DokuWiki before 2014-05-05a only checks for access to the root namespace, which allows remote attackers to access arbitrary images via a media file details ajax call. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/61983 - http://advisories.mageia.org/MGASA-2014-0438.html - https://github.com/splitbrain/dokuwiki/issues/765 - http://www.openwall.com/lists/oss-security/2014/10/13/3 - http://www.openwall.com/lists/oss-security/2014/10/16/9 - http://www.debian.org/
l.com/lists/oss-security/2014/10/13/3 - http://www.openwall.com/lists/oss-security/2014/10/16/9 - http://www.debian.org/security/2014/dsa-3059 - https://bugs.dokuwiki.org/index.php?do=details&task_id=2647#comment6204
CVE ID: CVE-2014-8762 State: PUBLISHED Published: 2014-10-22T14:00:00 Last Updated: 2024-08-06T13:26:02.550Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ajax_mediadiff function in DokuWiki before 2014-05-05a allows remote attackers to access arbitrary images via a crafted namespace in the ns parameter. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/61983 - http://advisories.mageia.org/MGASA-2014-0438.html - https://github.com/splitbrain/dokuwiki/issues/765 - http://www.securityfocus.com/bid/70404 - http://www.openwall.com/lists/oss-security/2014/10/13/3 - http://www.openwall.com/lists/oss-security/2014/10/16/9 - http://www.de
w.openwall.com/lists/oss-security/2014/10/13/3 - http://www.openwall.com/lists/oss-security/2014/10/16/9 - http://www.debian.org/security/2014/dsa-3059
CVE ID: CVE-2014-8763 State: PUBLISHED Published: 2014-10-22T14:00:00 Last Updated: 2024-08-06T13:26:02.588Z Vendors: n/a Products: n/a Problem Types: n/a Description: DokuWiki before 2014-05-05b, when using Active Directory for LDAP authentication, allows remote attackers to bypass authentication via a password starting with a null (\0) character and a valid user name, which triggers an unauthenticated bind. Additional Analyst Notes: - CVE Program Container: References: - http://www.freelists.org/post/dokuwiki/Fwd-Dokuwiki-maybe-security-issue-Null-byte-poisoning-in-LDAP-authentication - http://secunia.com/advisories/61983 - http://advisories.mageia.org/MGASA-2014-0438.html - http://www.ope
uthentication - http://secunia.com/advisories/61983 - http://advisories.mageia.org/MGASA-2014-0438.html - http://www.openwall.com/lists/oss-security/2014/10/13/3 - http://www.openwall.com/lists/oss-security/2014/10/16/9 - http://www.debian.org/security/2014/dsa-3059 - https://github.com/splitbrain/dokuwiki/pull/868
CVE ID: CVE-2014-8764 State: PUBLISHED Published: 2014-10-22T14:00:00 Last Updated: 2024-08-06T13:26:02.463Z Vendors: n/a Products: n/a Problem Types: n/a Description: DokuWiki 2014-05-05a and earlier, when using Active Directory for LDAP authentication, allows remote attackers to bypass authentication via a user name and password starting with a null (\0) character, which triggers an anonymous bind. Additional Analyst Notes: - CVE Program Container: References: - http://www.freelists.org/post/dokuwiki/Fwd-Dokuwiki-maybe-security-issue-Null-byte-poisoning-in-LDAP-authentication - http://secunia.com/advisories/61983 - http://advisories.mageia.org/MGASA-2014-0438.html - http://www.openwall.com
tion - http://secunia.com/advisories/61983 - http://advisories.mageia.org/MGASA-2014-0438.html - http://www.openwall.com/lists/oss-security/2014/10/13/3 - http://www.openwall.com/lists/oss-security/2014/10/16/9 - http://www.debian.org/security/2014/dsa-3059 - https://github.com/splitbrain/dokuwiki/pull/868
CVE ID: CVE-2014-8765 State: PUBLISHED Published: 2014-10-14T14:00:00Z Last Updated: 2024-09-17T01:05:41.017Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the Project Issue File Review module (PIFR) module 6.x-2.x before 6.x-2.17 for Drupal allow (1) remote attackers to inject arbitrary web script or HTML via a crafted patch, which triggers a PIFR client to test the patch and return the results to the PIFR_Server test results page or (2) remote authenticated users with the "manage PIFR environments" permission to inject arbitrary web script or HTML via vectors involving a PIFR_Server administrative page. Additional Analyst
sion to inject arbitrary web script or HTML via vectors involving a PIFR_Server administrative page. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/node/2205767 - http://www.securityfocus.com/bid/65830 - https://www.drupal.org/node/2205755 - http://secunia.com/advisories/57030