Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2014-9715 State: PUBLISHED Published: 2015-05-27T10:00:00 Last Updated: 2024-08-06T13:55:04.186Z Vendors: n/a Products: n/a Problem Types: n/a Description: include/net/netfilter/nf_conntrack_extend.h in the netfilter subsystem in the Linux kernel before 3.14.5 uses an insufficiently large data type for certain extension data, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) via outbound network traffic that triggers extension loading, as demonstrated by configuring a PPTP tunnel in a NAT environment. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/73953 - https://github.com/torvalds/linux/c
tes: - CVE Program Container: References: - http://www.securityfocus.com/bid/73953 - https://github.com/torvalds/linux/commit/223b02d923ecd7c84cf9780bb3686f455d279279 - http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.5 - http://marc.info/?l=netfilter-devel&m=140112364215200&w=2 - http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html - http://www.openwall.com/lists/oss-security/2015/04/08/1 - http://www.debian.org/security/2015/dsa-3237 - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=223b02d923ecd7c84cf9780bb3686f455d279279 - http://www.securitytracker.com/id/1032415 - http://rhn.redhat.com/errata/RHSA-2015-1534.html -
cf9780bb3686f455d279279 - http://www.securitytracker.com/id/1032415 - http://rhn.redhat.com/errata/RHSA-2015-1534.html - http://rhn.redhat.com/errata/RHSA-2015-1564.html - https://bugzilla.redhat.com/show_bug.cgi?id=1208684
CVE ID: CVE-2014-9716 State: PUBLISHED Published: 2015-05-08T14:00:00 Last Updated: 2024-08-06T13:55:04.582Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in WebODF before 0.5.4 allows remote attackers to inject arbitrary web script or HTML via a file name. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/74577 - https://github.com/kogmbh/WebODF/pull/851 - https://github.com/kogmbh/WebODF/blob/master/ChangeLog.md - https://owncloud.org/security/advisory/?id=oc-sa-2015-002
CVE ID: CVE-2014-9717 State: PUBLISHED Published: 2016-05-02T10:00:00 Last Updated: 2024-08-06T13:55:04.157Z Vendors: n/a Products: n/a Problem Types: n/a Description: fs/namespace.c in the Linux kernel before 4.0.2 processes MNT_DETACH umount2 system calls without verifying that the MNT_LOCKED flag is unset, which allows local users to bypass intended access restrictions and navigate to filesystem locations beneath a mount by calling umount2 within a user namespace. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00054.html - http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00056.html - https://g
-announce/2016-06/msg00054.html - http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00056.html - https://github.com/torvalds/linux/commit/ce07d891a0891d3c0d0c2d73d577490486b809e1 - http://www.openwall.com/lists/oss-security/2015/04/17/4 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ce07d891a0891d3c0d0c2d73d577490486b809e1 - https://bugzilla.redhat.com/show_bug.cgi?id=1226751 - https://groups.google.com/forum/message/raw?msg=linux.kernel/HnegnbXk0Vs/RClojwJzAFEJ - http://www.spinics.net/lists/linux-containers/msg30786.html - http://www.securityfocus.com/bid/74226 - http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.0.2 - http://lists.opensuse.o
/www.securityfocus.com/bid/74226 - http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.0.2 - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00000.html
CVE ID: CVE-2014-9718 State: PUBLISHED Published: 2015-04-21T16:00:00 Last Updated: 2024-08-06T13:55:04.598Z Vendors: n/a Products: n/a Problem Types: n/a Description: The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality in QEMU 1.0 through 2.1.3 have multiple interpretations of a function's return value, which allows guest OS users to cause a host OS denial of service (memory consumption or infinite loop, and system crash) via a PRDT with zero complete sectors, related to the bmdma_prepare_buf and ahci_dma_prepare_buf functions. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2015/dsa-3259 - http://openwall.com/lists/oss-security
E Program Container: References: - http://www.debian.org/security/2015/dsa-3259 - http://openwall.com/lists/oss-security/2015/04/20/7 - http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=3251bdcf1c67427d964517053c3d185b46e618e8 - http://www.securityfocus.com/bid/73316
CVE ID: CVE-2014-9720 State: PUBLISHED Published: 2020-01-24T17:03:38 Last Updated: 2024-08-06T13:55:04.572Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests. Additional Analyst Notes: - CVE Program Container: References: - http://www.tornadoweb.org/en/stable/releases/v3.2.2.html - https://github.com/tornadoweb/tornado/commit/1c36307463b1e8affae100bf9386948e6c1b2308 - https://bugzilla.novell.com/show_bug.cgi?id=930362 - https://bugzilla.red
mit/1c36307463b1e8affae100bf9386948e6c1b2308 - https://bugzilla.novell.com/show_bug.cgi?id=930362 - https://bugzilla.redhat.com/show_bug.cgi?id=1222816 - http://openwall.com/lists/oss-security/2015/05/19/4
CVE ID: CVE-2014-9721 State: PUBLISHED Published: 2015-06-03T20:00:00 Last Updated: 2024-08-06T13:55:04.751Z Vendors: n/a Products: n/a Problem Types: n/a Description: libzmq before 4.0.6 and 4.1.x before 4.1.1 allows remote attackers to conduct downgrade attacks and bypass ZMTP v3 protocol security mechanisms via a ZMTP v2 or earlier header. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zeromq/zeromq4-x/commit/b6e3e0f601e2c1ec1f3aac880ed6a3fe63043e51 - http://www.debian.org/security/2015/dsa-3255 - http://lists.fedoraproject.org/pipermail/package-announce/2015-May/159176.html - http://lists.opensuse.org/opensuse-updates/2015-06/msg00018.html - https://g
ail/package-announce/2015-May/159176.html - http://lists.opensuse.org/opensuse-updates/2015-06/msg00018.html - https://github.com/zeromq/libzmq/issues/1273
CVE ID: CVE-2014-9727 State: PUBLISHED Published: 2015-05-29T15:00:00Z Last Updated: 2024-09-17T02:51:53.595Z Vendors: n/a Products: n/a Problem Types: n/a Description: AVM Fritz!Box allows remote attackers to execute arbitrary commands via shell metacharacters in the var:lang parameter to cgi-bin/webcm. Additional Analyst Notes: - CVE Program Container: References: - https://www.trustwave.com/Resources/SpiderLabs-Blog/-Honeypot-Alert--Fritz%21Box-%E2%80%93-Remote-Command-Execution-Exploit-Attempt/ - http://www.exploit-db.com/exploits/33136 - http://www.osvdb.org/103289
CVE ID: CVE-2014-9728 State: PUBLISHED Published: 2015-08-31T10:00:00 Last Updated: 2024-08-06T13:55:03.931Z Vendors: n/a Products: n/a Problem Types: n/a Description: The UDF filesystem implementation in the Linux kernel before 3.18.2 does not validate certain lengths, which allows local users to cause a denial of service (buffer over-read and system crash) via a crafted filesystem image, related to fs/udf/inode.c and fs/udf/symlink.c. Additional Analyst Notes: - CVE Program Container: References: - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a1d47b262952a45aae62bd49cfaf33dd76c11a2c - https://github.com/torvalds/linux/commit/a1d47b262952a45aae62bd49cfaf33dd76c1
a1d47b262952a45aae62bd49cfaf33dd76c11a2c - https://github.com/torvalds/linux/commit/a1d47b262952a45aae62bd49cfaf33dd76c11a2c - http://www.openwall.com/lists/oss-security/2015/06/02/7 - https://github.com/torvalds/linux/commit/e237ec37ec154564f8690c5bd1795339955eeef9 - http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00021.html - http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00049.html - https://github.com/torvalds/linux/commit/e159332b9af4b04d882dbcfe1bb0117f0a6d4b58 - https://bugzilla.redhat.com/show_bug.cgi?id=1228229 - http://www.securityfocus.com/bid/74964 - http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00011.html - http://git.kernel.org
focus.com/bid/74964 - http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00011.html - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e159332b9af4b04d882dbcfe1bb0117f0a6d4b58 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e237ec37ec154564f8690c5bd1795339955eeef9 - http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.18.2 - http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00023.html - http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00018.html
CVE ID: CVE-2014-9729 State: PUBLISHED Published: 2015-08-31T10:00:00 Last Updated: 2024-08-06T13:55:04.335Z Vendors: n/a Products: n/a Problem Types: n/a Description: The udf_read_inode function in fs/udf/inode.c in the Linux kernel before 3.18.2 does not ensure a certain data-structure size consistency, which allows local users to cause a denial of service (system crash) via a crafted UDF filesystem image. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2015/06/02/7 - http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00021.html - http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00049.html - https://git
nnounce/2015-09/msg00021.html - http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00049.html - https://github.com/torvalds/linux/commit/e159332b9af4b04d882dbcfe1bb0117f0a6d4b58 - https://bugzilla.redhat.com/show_bug.cgi?id=1228229 - http://www.securityfocus.com/bid/74964 - http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00011.html - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e159332b9af4b04d882dbcfe1bb0117f0a6d4b58 - http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.18.2 - http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00023.html - http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00018.html
CVE ID: CVE-2014-9730 State: PUBLISHED Published: 2015-08-31T10:00:00 Last Updated: 2024-08-06T13:55:04.601Z Vendors: n/a Products: n/a Problem Types: n/a Description: The udf_pc_to_char function in fs/udf/symlink.c in the Linux kernel before 3.18.2 relies on component lengths that are unused, which allows local users to cause a denial of service (system crash) via a crafted UDF filesystem image. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2015/06/02/7 - https://github.com/torvalds/linux/commit/e237ec37ec154564f8690c5bd1795339955eeef9 - http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00021.html - http://lists.ope
f8690c5bd1795339955eeef9 - http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00021.html - http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00049.html - https://bugzilla.redhat.com/show_bug.cgi?id=1228229 - http://www.securityfocus.com/bid/74964 - http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00011.html - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e237ec37ec154564f8690c5bd1795339955eeef9 - http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.18.2 - http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00023.html - http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00018.html
CVE ID: CVE-2014-9731 State: PUBLISHED Published: 2015-08-31T10:00:00 Last Updated: 2024-08-06T13:55:05.083Z Vendors: n/a Products: n/a Problem Types: n/a Description: The UDF filesystem implementation in the Linux kernel before 3.18.2 does not ensure that space is available for storing a symlink target's name along with a trailing \0 character, which allows local users to obtain sensitive information via a crafted filesystem image, related to fs/udf/symlink.c and fs/udf/unicode.c. Additional Analyst Notes: - CVE Program Container: References: - https://source.android.com/security/bulletin/2017-07-01 - http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00021.html - https://githu
ecurity/bulletin/2017-07-01 - http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00021.html - https://github.com/torvalds/linux/commit/0e5cc9a40ada6046e6bc3bdfcd0c0d7e4b706b14 - http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00049.html - http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00011.html - http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.18.2 - https://bugzilla.redhat.com/show_bug.cgi?id=1228220 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=0e5cc9a40ada6046e6bc3bdfcd0c0d7e4b706b14 - http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00023.html - http://lists.opensuse.org/opensuse-security-
ttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00023.html - http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00018.html - http://www.openwall.com/lists/oss-security/2015/06/03/4 - http://www.securityfocus.com/bid/75001
CVE ID: CVE-2014-9732 State: PUBLISHED Published: 2015-06-11T14:00:00 Last Updated: 2024-08-06T13:55:04.519Z Vendors: n/a Products: n/a Problem Types: n/a Description: The cabd_extract function in cabd.c in libmspack before 0.5 does not properly maintain decompression callbacks in certain cases where an invalid file follows a valid file, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted CAB archive. Additional Analyst Notes: - CVE Program Container: References: - http://openwall.com/lists/oss-security/2015/02/03/11 - https://bugs.debian.org/774665 - http://www.securityfocus.com/bid/72474
CVE ID: CVE-2014-9733 State: PUBLISHED Published: 2017-10-17T14:00:00 Last Updated: 2024-08-06T13:55:04.560Z Vendors: n/a Products: n/a Problem Types: n/a Description: nw.js before 0.11.5 can simulate user input events in a normal frame, which allows remote attackers to have unspecified impact via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nwjs/nw.js/blob/nw11/CHANGELOG.md
CVE ID: CVE-2014-9734 State: PUBLISHED Published: 2015-06-30T14:00:00Z Last Updated: 2024-09-16T16:33:46.372Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the Slider Revolution (revslider) plugin before 4.2 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the img parameter in a revslider_show_image action to wp-admin/admin-ajax.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/34511 - http://marketblog.envato.com/news/affected-themes/ - https://blog.sucuri.net/2014/09/slider-revolution-plugin-critical-vulnerability-being-exploited.html - https://blog.su
- https://blog.sucuri.net/2014/09/slider-revolution-plugin-critical-vulnerability-being-exploited.html - https://blog.sucuri.net/2014/12/revslider-vulnerability-leads-to-massive-wordpress-soaksoak-compromise.html - http://packetstormsecurity.com/files/132366/WordPress-Revslider-4.2.2-XSS-Information-Disclosure.html - http://marketblog.envato.com/news/plugin-vulnerability/ - https://plugins.trac.wordpress.org/browser/patch-for-revolution-slider/trunk/revsliderpatch.php
CVE ID: CVE-2014-9735 State: PUBLISHED Published: 2015-06-30T14:00:00 Last Updated: 2024-08-06T13:55:04.674Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ThemePunch Slider Revolution (revslider) plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier for Wordpress does not properly restrict access to administrator AJAX functionality, which allows remote attackers to (1) upload and execute arbitrary files via an update_plugin action; (2) delete arbitrary sliders via a delete_slider action; and (3) create, (4) update, (5) import, or (6) export arbitrary sliders via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https:
xport arbitrary sliders via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/7954 - https://blog.sucuri.net/2014/12/revslider-vulnerability-leads-to-massive-wordpress-soaksoak-compromise.html - http://www.themepunch.com/products/old-revolution-slider-pre-4-2-vulnerabilty-explained/ - http://seclists.org/fulldisclosure/2014/Nov/78 - http://www.securityfocus.com/bid/71306 - https://plugins.trac.wordpress.org/browser/patch-for-revolution-slider/trunk/revsliderpatch.php - https://whatisgon.wordpress.com/2014/11/30/another-revslider-vulnerability/
CVE ID: CVE-2014-9736 State: PUBLISHED Published: 2015-08-04T10:00:00 Last Updated: 2024-08-06T13:55:04.528Z Vendors: n/a Products: n/a Problem Types: n/a Description: GE Healthcare Centricity Clinical Archive Audit Trail Repository has a default password of initinit for the (1) SSL key manager and (2) server keystore; (3) keystore_password for the server truststore; and atna for the (4) primary storage database and (5) archive storage database, which has unspecified impact and attack vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.forbes.com/sites/thomasbrewster/2015/07/10/vulnerable-breasts/ - http://apps.gehealthcare.com/servlet/ClientServlet/DOC147407
s.com/sites/thomasbrewster/2015/07/10/vulnerable-breasts/ - http://apps.gehealthcare.com/servlet/ClientServlet/DOC1474072_ATR_InstSvcMan.pdf?REQ=RAA&DIRECTION=DOC1474072&FILENAME=DOC1474072_ATR_InstSvcMan.pdf&FILEREV=--&DOCREV_ORG=-- - https://twitter.com/digitalbond/status/619250429751222277
CVE ID: CVE-2014-9737 State: PUBLISHED Published: 2015-07-06T14:55:00Z Last Updated: 2024-09-16T20:22:00.234Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open redirect vulnerability in the Language Switcher Dropdown module 7.x-1.x before 7.x-1.4 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a block. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/node/2179123 - http://osvdb.org/102382 - https://www.drupal.org/node/1614372
CVE ID: CVE-2014-9738 State: PUBLISHED Published: 2015-07-06T14:55:00Z Last Updated: 2024-09-16T20:07:04.097Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the Tournament module 7.x-1.x before 7.x-1.2 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via an (1) account username, a (2) node title, or a (3) team entity title. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/71198 - https://www.drupal.org/node/2378401 - https://www.drupal.org/node/2378289
CVE ID: CVE-2014-9739 State: PUBLISHED Published: 2015-07-06T14:55:00Z Last Updated: 2024-09-16T22:20:11.118Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Node Field module 7.x-2.x before 7.x-2.45 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors involving internal fields. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/node/2378287 - http://www.securityfocus.com/bid/71201 - https://www.drupal.org/node/2373157
CVE ID: CVE-2014-9740 State: PUBLISHED Published: 2015-07-06T14:55:00Z Last Updated: 2024-09-16T23:20:40.686Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Rules Link module 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "administer rules links" permission to inject arbitrary web script or HTML via unspecified vectors, which are not properly handled in the (1) question and (2) description strings in a confirmation form for a triggering Rules link. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/node/2328567 - https://www.drupal.org/node/2328549 - http://www.secur
am Container: References: - https://www.drupal.org/node/2328567 - https://www.drupal.org/node/2328549 - http://www.securityfocus.com/bid/69447
CVE ID: CVE-2014-9741 State: PUBLISHED Published: 2015-07-08T15:00:00Z Last Updated: 2024-09-16T19:24:45.891Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in ESRI ArcGIS for Desktop, ArcGIS for Engine, and ArcGIS for Server 10.2.2 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://blogs.esri.com/esri/arcgis/2014/09/04/arcgis-for-server-security-patch-10-1-sp1-qip-10-2-1-10-2-2/ - http://www.securitytracker.com/id/1032733 - http://support.esri.com/en/downloads/patches-servicepacks/view/productid/67/metaid/2223
CVE ID: CVE-2014-9742 State: PUBLISHED Published: 2016-05-13T14:00:00 Last Updated: 2024-08-06T13:55:04.544Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Miller-Rabin primality check in Botan before 1.10.8 and 1.11.x before 1.11.9 improperly uses a single random base, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a DH group. Additional Analyst Notes: - CVE Program Container: References: - http://botan.randombit.net/security.html - http://marc.info/?l=botan-devel&m=139717503205066&w=2
CVE ID: CVE-2014-9743 State: PUBLISHED Published: 2015-08-17T15:00:00Z Last Updated: 2024-09-16T18:28:29.581Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the httpd_HtmlError function in network/httpd.c in the web interface in VideoLAN VLC Media Player before 2.2.0 allows remote attackers to inject arbitrary web script or HTML via the path info. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2014/Mar/324 - http://www.securityfocus.com/bid/66307 - http://git.videolan.org/?p=vlc.git%3Ba=commit%3Bh=fe5063ec5ad1873039ea719eb1f137c8f3bda84b - http://www.quantumleap.it/vlc-reflected-xss-v
n.org/?p=vlc.git%3Ba=commit%3Bh=fe5063ec5ad1873039ea719eb1f137c8f3bda84b - http://www.quantumleap.it/vlc-reflected-xss-vulnerability/
CVE ID: CVE-2014-9744 State: PUBLISHED Published: 2015-08-24T15:00:00Z Last Updated: 2024-09-16T18:33:17.615Z Vendors: n/a Products: n/a Problem Types: n/a Description: Memory leak in PolarSSL before 1.3.9 allows remote attackers to cause a denial of service (memory consumption) via a large number of ClientHello messages. NOTE: this identifier was SPLIT from CVE-2014-8628 per ADT3 due to different affected versions. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-updates/2014-11/msg00079.html - https://polarssl.org/tech-updates/releases/polarssl-1.3.9-released
CVE ID: CVE-2014-9745 State: PUBLISHED Published: 2015-09-14T20:00:00 Last Updated: 2024-08-06T13:55:04.639Z Vendors: n/a Products: n/a Problem Types: n/a Description: The parse_encoding function in type1/t1load.c in FreeType before 2.5.3 allows remote attackers to cause a denial of service (infinite loop) via a "broken number-with-base" in a Postscript stream, as demonstrated by 8#garbage. Additional Analyst Notes: - CVE Program Container: References: - http://www.ubuntu.com/usn/USN-2739-1 - http://lists.opensuse.org/opensuse-updates/2015-10/msg00017.html - http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=df14e6c0b9592cbb24d5381dfc6106b14f915e75 - http://www.securityfocus.