Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2014-3137 State: PUBLISHED Published: 2014-10-25T22:00:00 Last Updated: 2024-08-06T10:35:56.668Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bottle 0.10.x before 0.10.12, 0.11.x before 0.11.7, and 0.12.x before 0.12.6 does not properly limit content types, which allows remote attackers to bypass intended access restrictions via an accepted Content-Type followed by a ; (semi-colon) and a Content-Type that would not be accepted, as demonstrated in YouCompleteMe to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/defnull/bottle/issues/616 - https://bugzilla.redhat.com/show_bug.cgi?id=1093255 - http://www.openw
- https://github.com/defnull/bottle/issues/616 - https://bugzilla.redhat.com/show_bug.cgi?id=1093255 - http://www.openwall.com/lists/oss-security/2014/05/01/15 - http://www.debian.org/security/2014/dsa-2948
CVE ID: CVE-2014-3138 State: PUBLISHED Published: 2014-05-02T00:00:00 Last Updated: 2024-08-06T10:35:56.969Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Xerox DocuShare before 6.53 Patch 6 Hotfix 2, 6.6.1 Update 1 before Hotfix 24, and 6.6.1 Update 2 before Hotfix 3 allows remote authenticated users to execute arbitrary SQL commands via the PATH_INFO to /docushare/dsweb/ResultBackgroundJobMultiple/. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.xerox.com/download/security/security-bulletin/a72cd-4f7a54ce14460/cert_XRX14-003_V1.0.pdf - http://www.e
s: - http://www.xerox.com/download/security/security-bulletin/a72cd-4f7a54ce14460/cert_XRX14-003_V1.0.pdf - http://www.exploit-db.com/exploits/32886 - http://www.osvdb.org/105972 - http://secunia.com/advisories/57996 - http://packetstormsecurity.com/files/126171/Xerox-DocuShare-SQL-Injection.html - http://www.securityfocus.com/bid/66922 - https://exchange.xforce.ibmcloud.com/vulnerabilities/92548 - http://seclists.org/fulldisclosure/2014/Apr/205
CVE ID: CVE-2014-3139 State: PUBLISHED Published: 2014-05-02T10:00:00Z Last Updated: 2024-09-17T02:06:06.731Z Vendors: n/a Products: n/a Problem Types: n/a Description: recoveryconsole/bpl/snmpd.php in Unitrends Enterprise Backup 7.3.0 allows remote attackers to bypass authentication by setting the auth parameter to a certain string. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/brandonprry/10745756 - http://seclists.org/fulldisclosure/2014/Apr/204 - http://www.exploit-db.com/exploits/32885
CVE ID: CVE-2014-3140 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2014-3144 State: PUBLISHED Published: 2014-05-11T21:00:00 Last Updated: 2024-08-06T10:35:56.534Z Vendors: n/a Products: n/a Problem Types: n/a Description: The (1) BPF_S_ANC_NLATTR and (2) BPF_S_ANC_NLATTR_NEST extension implementations in the sk_run_filter function in net/core/filter.c in the Linux kernel through 3.14.3 do not check whether a certain length value is sufficiently large, which allows local users to cause a denial of service (integer underflow and system crash) via crafted BPF instructions. NOTE: the affected code was moved to the __skb_get_nlattr and __skb_get_nlattr_nest functions before the vulnerability was announced. Additional Analyst Notes: - CVE Program Con
and __skb_get_nlattr_nest functions before the vulnerability was announced. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2014/05/09/6 - http://www.ubuntu.com/usn/USN-2263-1 - http://www.debian.org/security/2014/dsa-2949 - http://www.ubuntu.com/usn/USN-2261-1 - http://www.ubuntu.com/usn/USN-2252-1 - http://linux.oracle.com/errata/ELSA-2014-3052.html - http://secunia.com/advisories/58990 - http://secunia.com/advisories/60613 - http://www.ubuntu.com/usn/USN-2264-1 - https://github.com/torvalds/linux/commit/05ab8f2647e4221cbdb3856dd7d32bd5407316b3 - http://www.securityfocus.com/bid/67309 - http://git.kernel.org/?p=linux/kernel/git/t
647e4221cbdb3856dd7d32bd5407316b3 - http://www.securityfocus.com/bid/67309 - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=05ab8f2647e4221cbdb3856dd7d32bd5407316b3 - http://www.ubuntu.com/usn/USN-2262-1 - http://www.ubuntu.com/usn/USN-2259-1 - http://www.ubuntu.com/usn/USN-2251-1 - http://secunia.com/advisories/59311 - http://secunia.com/advisories/59597
CVE ID: CVE-2014-3145 State: PUBLISHED Published: 2014-05-11T21:00:00 Last Updated: 2024-08-06T10:35:56.598Z Vendors: n/a Products: n/a Problem Types: n/a Description: The BPF_S_ANC_NLATTR_NEST extension implementation in the sk_run_filter function in net/core/filter.c in the Linux kernel through 3.14.3 uses the reverse order in a certain subtraction, which allows local users to cause a denial of service (over-read and system crash) via crafted BPF instructions. NOTE: the affected code was moved to the __skb_get_nlattr_nest function before the vulnerability was announced. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2014/05/09/6
dditional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2014/05/09/6 - http://www.ubuntu.com/usn/USN-2263-1 - http://www.debian.org/security/2014/dsa-2949 - https://source.android.com/security/bulletin/2017-04-01 - http://www.ubuntu.com/usn/USN-2261-1 - http://www.ubuntu.com/usn/USN-2252-1 - http://linux.oracle.com/errata/ELSA-2014-3052.html - http://secunia.com/advisories/58990 - http://secunia.com/advisories/60613 - http://www.ubuntu.com/usn/USN-2264-1 - https://github.com/torvalds/linux/commit/05ab8f2647e4221cbdb3856dd7d32bd5407316b3 - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=05ab8f2647e4221cbdb3856d
32bd5407316b3 - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=05ab8f2647e4221cbdb3856dd7d32bd5407316b3 - http://www.ubuntu.com/usn/USN-2262-1 - http://www.securityfocus.com/bid/67321 - http://www.ubuntu.com/usn/USN-2259-1 - http://www.ubuntu.com/usn/USN-2251-1 - http://secunia.com/advisories/59311 - http://secunia.com/advisories/59597 - http://www.securitytracker.com/id/1038201
CVE ID: CVE-2014-3146 State: PUBLISHED Published: 2014-05-14T19:00:00 Last Updated: 2024-08-06T10:35:56.613Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the clean_html function. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2014/dsa-2941 - http://lxml.de/3.3/changes-3.3.5.html - http://www.openwall.com/lists/oss-security/2014/05/09/7 - http://www.ubuntu.com/usn/USN-2217-1 - https://mailman-mail5.webfaction.com/pipermail/lxml/2014-
security/2014/05/09/7 - http://www.ubuntu.com/usn/USN-2217-1 - https://mailman-mail5.webfaction.com/pipermail/lxml/2014-April/007128.html - http://secunia.com/advisories/58744 - http://advisories.mageia.org/MGASA-2014-0218.html - http://www.securityfocus.com/bid/67159 - http://www.mandriva.com/security/advisories?name=MDVSA-2015:112 - http://secunia.com/advisories/58013 - http://seclists.org/fulldisclosure/2014/Apr/210 - http://secunia.com/advisories/59008 - http://lists.opensuse.org/opensuse-updates/2014-05/msg00083.html - http://seclists.org/fulldisclosure/2014/Apr/319
CVE ID: CVE-2014-3147 State: PUBLISHED Published: 2014-10-10T01:00:00 Last Updated: 2024-08-06T10:35:56.563Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the auto-complete feature in Splunk Enterprise before 6.0.4 allows remote authenticated users to inject arbitrary web script or HTML via a CSV file. Additional Analyst Notes: - CVE Program Container: References: - http://securitytracker.com/id?1030800 - http://www.splunk.com/view/SP-CAAAMSH
CVE ID: CVE-2014-3148 State: PUBLISHED Published: 2015-08-31T18:00:00 Last Updated: 2024-08-06T10:35:56.675Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in libahttp/err.c in OkCupid OKWS (OK Web Server) allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to a non-existent page, which is not properly handled in a 404 error page. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/128338/OKCupid-Cross-Site-Scripting.html - https://github.com/okws/okws/commit/e9bedb644d106a043e33e1058bedd1c2c0b2e2e0 - https://twitter.com/infosecmaverick/status/462573038299803648
kws/okws/commit/e9bedb644d106a043e33e1058bedd1c2c0b2e2e0 - https://twitter.com/infosecmaverick/status/462573038299803648 - https://hackerone.com/reports/3317
CVE ID: CVE-2014-3149 State: PUBLISHED Published: 2014-07-03T14:00:00 Last Updated: 2024-08-06T10:35:56.500Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Invision Power IP.Board (aka IPB or Power Board) 3.3.x and 3.4.x through 3.4.6, as downloaded before 20140424, or IP.Nexus 1.5.x through 1.5.9, as downloaded before 20140424, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/532618/100/0/threaded - http://www.christian-schneider.net/advisories/CVE-2014-3149.txt - http://packetstormsecurity.com/
32618/100/0/threaded - http://www.christian-schneider.net/advisories/CVE-2014-3149.txt - http://packetstormsecurity.com/files/127328/IP.Board-3.4.x-3.3.x-Cross-Site-Scripting.html - http://community.invisionpower.com/topic/399747-ipboard-33x-34x-security-update - http://www.securityfocus.com/bid/67164
CVE ID: CVE-2014-3150 State: PUBLISHED Published: 2017-11-15T18:00:00 Last Updated: 2024-08-06T10:35:56.385Z Vendors: n/a Products: n/a Problem Types: n/a Description: Livebox 1.1 allows remote authenticated users to upload arbitrary configuration files, download the configuration file, or obtain sensitive information via crafted Javascript. Additional Analyst Notes: - CVE Program Container: References: - https://archive.fo/TZQpD
CVE ID: CVE-2014-3152 State: PUBLISHED Published: 2014-05-21T10:00:00 Last Updated: 2024-08-06T10:35:56.561Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer underflow in the LCodeGen::PrepareKeyedOperand function in arm/lithium-codegen-arm.cc in Google V8 before 3.25.28.16, as used in Google Chrome before 35.0.1916.114, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a negative key value. Additional Analyst Notes: - CVE Program Container: References: - http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157363.html - https://code.google.com/p/v8/source/detail?r=20363 - http://lists.fedor
ipermail/package-announce/2015-May/157363.html - https://code.google.com/p/v8/source/detail?r=20363 - http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157338.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157357.html - http://www.debian.org/security/2014/dsa-2939 - http://googlechromereleases.blogspot.com/2014/05/stable-channel-update_20.html - http://secunia.com/advisories/60372 - http://lists.opensuse.org/opensuse-updates/2014-06/msg00023.html - https://code.google.com/p/chromium/issues/detail?id=358057 - http://secunia.com/advisories/59155 - http://secunia.com/advisories/58920 - http://www.securitytracker.com/id/1030270
CVE ID: CVE-2014-3153 State: PUBLISHED Published: 2014-06-07T14:00:00.000Z Last Updated: 2025-10-22T00:05:37.360Z Vendors: n/a Products: n/a Problem Types: n/a Description: The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter modification. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securityfocus.com/bid/67906 - http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00006.html - http://openwall.com/lists/oss-security/2014/06/05/2
ists.opensuse.org/opensuse-security-announce/2014-07/msg00006.html - http://openwall.com/lists/oss-security/2014/06/05/24 - http://secunia.com/advisories/59029 - http://www.debian.org/security/2014/dsa-2949 - http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00006.html - http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00018.html - http://secunia.com/advisories/59262 - http://secunia.com/advisories/58990 - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=13fbca4c6ecd96ec1a1cfa2e4f2ce191fe928a5e - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=54a217887a7b658e2650c3feff22756ab80c7339 - http://git.kernel.org/?p=
cgit/linux/kernel/git/torvalds/linux.git/commit/?id=54a217887a7b658e2650c3feff22756ab80c7339 - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e9c243a5a6de0be8e584c604d353412584b592f8 - http://linux.oracle.com/errata/ELSA-2014-3037.html - http://secunia.com/advisories/59153 - http://openwall.com/lists/oss-security/2014/06/06/20 - http://secunia.com/advisories/59309 - https://github.com/torvalds/linux/commit/e9c243a5a6de0be8e584c604d353412584b592f8 - http://www.securitytracker.com/id/1030451 - http://linux.oracle.com/errata/ELSA-2014-0771.html - http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00014.html - http://rhn.redhat.com/errata/RHSA-2014-0
- http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00014.html - http://rhn.redhat.com/errata/RHSA-2014-0800.html - http://www.ubuntu.com/usn/USN-2237-1 - http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00007.html - http://linux.oracle.com/errata/ELSA-2014-3039.html - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b3eaa9fc5cd0a4d74b18f6b8dc617aeaf1873270 - http://secunia.com/advisories/58500 - http://www.ubuntu.com/usn/USN-2240-1 - https://bugzilla.redhat.com/show_bug.cgi?id=1103626 - http://secunia.com/advisories/59386 - http://www.exploit-db.com/exploits/35370 - http://secunia.com/advisories/59599 - http://lists.opensuse.org/opensu
9386 - http://www.exploit-db.com/exploits/35370 - http://secunia.com/advisories/59599 - http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00025.html - http://www.openwall.com/lists/oss-security/2014/06/05/22 - http://secunia.com/advisories/59092 - http://linux.oracle.com/errata/ELSA-2014-3038.html - http://www.openwall.com/lists/oss-security/2021/02/01/4 - https://www.openwall.com/lists/oss-security/2021/02/01/4 - https://elongl.github.io/exploitation/2021/01/08/cve-2014-3153.html - https://github.com/elongl/CVE-2014-3153
CVE ID: CVE-2014-3154 State: PUBLISHED Published: 2014-06-11T10:00:00 Last Updated: 2024-08-06T10:35:56.706Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use-after-free vulnerability in the ChildThread::Shutdown function in content/child/child_thread.cc in the filesystem API in Google Chrome before 35.0.1916.153 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to a Blink shutdown. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/59090 - http://googlechromereleases.blogspot.com/2014/06/stable-channel-update.html - https://src.chromium.org/viewvc/chrome?revision=269345&
chromereleases.blogspot.com/2014/06/stable-channel-update.html - https://src.chromium.org/viewvc/chrome?revision=269345&view=revision - http://security.gentoo.org/glsa/glsa-201408-16.xml - http://secunia.com/advisories/60372 - http://www.securityfocus.com/bid/67977 - http://secunia.com/advisories/60061 - https://src.chromium.org/viewvc/blink?revision=173620&view=revision - http://secunia.com/advisories/58585 - https://code.google.com/p/chromium/issues/detail?id=369525 - http://www.debian.org/security/2014/dsa-2959
CVE ID: CVE-2014-3155 State: PUBLISHED Published: 2014-06-11T10:00:00 Last Updated: 2024-08-06T10:35:56.666Z Vendors: n/a Products: n/a Problem Types: n/a Description: net/spdy/spdy_write_queue.cc in the SPDY implementation in Google Chrome before 35.0.1916.153 allows remote attackers to cause a denial of service (out-of-bounds read) by leveraging incorrect queue maintenance. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/67980 - https://src.chromium.org/viewvc/chrome?revision=268730&view=revision - http://secunia.com/advisories/59090 - http://googlechromereleases.blogspot.com/2014/06/stable-channel-update.html - http://security.gentoo.org/g
ories/59090 - http://googlechromereleases.blogspot.com/2014/06/stable-channel-update.html - http://security.gentoo.org/glsa/glsa-201408-16.xml - http://secunia.com/advisories/60372 - https://code.google.com/p/chromium/issues/detail?id=369539 - http://secunia.com/advisories/60061 - https://src.chromium.org/viewvc/chrome?revision=269246&view=revision - https://src.chromium.org/viewvc/chrome?revision=267984&view=revision - http://secunia.com/advisories/58585 - http://www.debian.org/security/2014/dsa-2959
CVE ID: CVE-2014-3156 State: PUBLISHED Published: 2014-06-11T10:00:00 Last Updated: 2024-08-06T10:35:56.593Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the clipboard implementation in Google Chrome before 35.0.1916.153 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger unexpected bitmap data, related to content/renderer/renderer_clipboard_client.cc and content/renderer/webclipboard_impl.cc. Additional Analyst Notes: - CVE Program Container: References: - https://code.google.com/p/chromium/issues/detail?id=369621 - http://secunia.com/advisories/59090 - http://googlechromereleases.blogspot.c
le.com/p/chromium/issues/detail?id=369621 - http://secunia.com/advisories/59090 - http://googlechromereleases.blogspot.com/2014/06/stable-channel-update.html - http://security.gentoo.org/glsa/glsa-201408-16.xml - http://secunia.com/advisories/60061 - https://src.chromium.org/viewvc/chrome?revision=271730&view=revision - http://www.securityfocus.com/bid/67981 - http://secunia.com/advisories/58585 - http://www.debian.org/security/2014/dsa-2959
CVE ID: CVE-2014-3157 State: PUBLISHED Published: 2014-06-11T10:00:00 Last Updated: 2024-08-06T10:35:56.467Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in the FFmpegVideoDecoder::GetVideoBuffer function in media/filters/ffmpeg_video_decoder.cc in Google Chrome before 35.0.1916.153 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging VideoFrame data structures that are too small for proper interaction with an underlying FFmpeg library. Additional Analyst Notes: - CVE Program Container: References: - https://src.chromium.org/viewvc/chrome?revision=268831&view=revision - http://www.securityfocus.c
ntainer: References: - https://src.chromium.org/viewvc/chrome?revision=268831&view=revision - http://www.securityfocus.com/bid/67972 - https://code.google.com/p/chromium/issues/detail?id=368980 - http://secunia.com/advisories/59090 - http://googlechromereleases.blogspot.com/2014/06/stable-channel-update.html - http://security.gentoo.org/glsa/glsa-201408-16.xml - http://secunia.com/advisories/60372 - http://secunia.com/advisories/60061 - http://secunia.com/advisories/58585 - http://www.debian.org/security/2014/dsa-2959
CVE ID: CVE-2014-3158 State: PUBLISHED Published: 2014-11-15T21:00:00 Last Updated: 2024-08-06T10:35:56.933Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow in the getword function in options.c in pppd in Paul's PPP Package (ppp) before 2.4.7 allows attackers to "access privileged options" via a long word in an options file, which triggers a heap-based buffer overflow that "[corrupts] security-relevant variables." Additional Analyst Notes: - CVE Program Container: References: - http://www.ubuntu.com/usn/USN-2429-1 - http://marc.info/?l=linux-ppp&m=140764978420764 - http://www.mandriva.com/security/advisories?name=MDVSA-2015:135 - http://www.oracle.com/technetwork/
m=140764978420764 - http://www.mandriva.com/security/advisories?name=MDVSA-2015:135 - http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html - https://bugzilla.redhat.com/show_bug.cgi?id=1128748 - http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136932.html - http://www.debian.org/security/2014/dsa-3079 - http://advisories.mageia.org/MGASA-2014-0368.html - https://github.com/paulusmack/ppp/commit/7658e8257183f062dc01f87969c140707c7e52cb
CVE ID: CVE-2014-3159 State: PUBLISHED Published: 2014-07-20T10:00:00 Last Updated: 2024-08-06T10:35:56.562Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WebContentsDelegateAndroid::OpenURLFromTab function in components/web_contents_delegate_android/web_contents_delegate_android.cc in Google Chrome before 36.0.1985.122 on Android does not properly restrict URL loading, which allows remote attackers to spoof the URL in the Omnibox via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://googlechromereleases.blogspot.com/2014/07/chrome-for-android-update.html - https://code.google.com/p/chromium/issues/detail?id=352083 - https://src.chr
om/2014/07/chrome-for-android-update.html - https://code.google.com/p/chromium/issues/detail?id=352083 - https://src.chromium.org/viewvc/chrome?revision=273865&view=revision
CVE ID: CVE-2014-3160 State: PUBLISHED Published: 2014-07-20T10:00:00 Last Updated: 2024-08-06T10:35:56.778Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ResourceFetcher::canRequest function in core/fetch/ResourceFetcher.cpp in Blink, as used in Google Chrome before 36.0.1985.125, does not properly restrict subresource requests associated with SVG files, which allows remote attackers to bypass the Same Origin Policy via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/68677 - https://src.chromium.org/viewvc/blink?revision=176084&view=revision - http://security.gentoo.org/glsa/glsa-201408-16.xml - http://secuni
mium.org/viewvc/blink?revision=176084&view=revision - http://security.gentoo.org/glsa/glsa-201408-16.xml - http://secunia.com/advisories/60372 - http://googlechromereleases.blogspot.com/2014/07/stable-channel-update.html - http://secunia.com/advisories/60061 - http://www.debian.org/security/2014/dsa-3039 - https://code.google.com/p/chromium/issues/detail?id=380885
CVE ID: CVE-2014-3161 State: PUBLISHED Published: 2014-07-20T10:00:00 Last Updated: 2024-08-06T10:35:56.628Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WebMediaPlayerAndroid::load function in content/renderer/media/android/webmediaplayer_android.cc in Google Chrome before 36.0.1985.122 on Android does not properly interact with redirects, which allows remote attackers to bypass the Same Origin Policy via a crafted web site that hosts a video stream. Additional Analyst Notes: - CVE Program Container: References: - http://googlechromereleases.blogspot.com/2014/07/chrome-for-android-update.html - https://src.chromium.org/viewvc/chrome?revision=266396&view=revision - https://
2014/07/chrome-for-android-update.html - https://src.chromium.org/viewvc/chrome?revision=266396&view=revision - https://code.google.com/p/chromium/issues/detail?id=334204