Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
dditional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/69142 - http://secunia.com/advisories/60673 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-045
CVE ID: CVE-2014-0319 State: PUBLISHED Published: 2014-03-12T01:00:00 Last Updated: 2024-08-06T09:13:10.297Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Silverlight 5 before 5.1.30214.0 and Silverlight 5 Developer Runtime before 5.1.30214.0 allow attackers to bypass the DEP and ASLR protection mechanisms via unspecified vectors, aka "Silverlight DEP/ASLR Bypass Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-014
CVE ID: CVE-2014-0320 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2014-0321 State: PUBLISHED Published: 2014-03-12T01:00:00 Last Updated: 2024-08-06T09:13:09.770Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0313. Additional Analyst Notes: - CVE Program Container: References: - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-012
CVE ID: CVE-2014-0322 State: PUBLISHED Published: 2014-02-14T16:00:00.000Z Last Updated: 2025-10-22T00:05:39.021Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via vectors involving crafted JavaScript code, CMarkup, and the onpropertychange attribute of a script element, as exploited in the wild in January and February 2014. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.fireeye.com/blog/technical/cyber-exploits/2014/02/new-ie-zero-day-found-in-watering-hole-attack-2.html - http://www.osvdb.org/103354 - http:
hnical/cyber-exploits/2014/02/new-ie-zero-day-found-in-watering-hole-attack-2.html - http://www.osvdb.org/103354 - http://www.exploit-db.com/exploits/32851 - http://technet.microsoft.com/security/advisory/2934088 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-012 - http://www.kb.cert.org/vuls/id/732479 - http://twitter.com/nanoc0re/statuses/434251658344673281 - http://community.websense.com/blogs/securitylabs/archive/2014/02/13/msie-0-day-exploit-cve-2014-0322-possibly-targeting-french-aerospace-organization.aspx - https://www.dropbox.com/s/pyxjgycmudirbqe/CVE-2014-0322.zip - http://www.fireeye.com/blog/uncategorized/2014/02/operation-snowman-deputydog-actor-
pyxjgycmudirbqe/CVE-2014-0322.zip - http://www.fireeye.com/blog/uncategorized/2014/02/operation-snowman-deputydog-actor-compromises-us-veterans-of-foreign-wars-website.html - http://www.exploit-db.com/exploits/32904
CVE ID: CVE-2014-0323 State: PUBLISHED Published: 2014-03-12T01:00:00 Last Updated: 2024-08-06T09:13:09.837Z Vendors: n/a Products: n/a Problem Types: n/a Description: win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to obtain sensitive information from kernel memory or cause a denial of service (system hang) via a crafted application, aka "Win32k Information Disclosure Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - https://docs.microsof
mation Disclosure Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-015
CVE ID: CVE-2014-0324 State: PUBLISHED Published: 2014-03-12T01:00:00 Last Updated: 2024-08-06T09:13:09.733Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0297, CVE-2014-0308, and CVE-2014-0312. Additional Analyst Notes: - CVE Program Container: References: - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-012
CVE ID: CVE-2014-0325 State: PUBLISHED Published: 2014-07-03T14:00:00 Last Updated: 2024-08-06T09:13:10.123Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site that triggers improper processing of CElement objects, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1751 and CVE-2014-1755. NOTE: MS14-018 originally had a typo of CVE-2014-0235 for this. Additional Analyst Notes: - CVE Program Container: References: - https://docs.microsoft.com/en-us/security-u
5 for this. Additional Analyst Notes: - CVE Program Container: References: - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-018 - http://zerodayinitiative.com/advisories/ZDI-14-078/ - http://www.securityfocus.com/bid/66646
CVE ID: CVE-2014-0326 State: PUBLISHED Published: 2014-08-17T23:00:00 Last Updated: 2024-08-06T09:13:10.239Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Pilot Below Deck Equipment (BDE) and OpenPort implementations on Iridium satellite terminals allow remote attackers to read hardcoded credentials via the web interface. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/578598
CVE ID: CVE-2014-0327 State: PUBLISHED Published: 2014-08-17T23:00:00 Last Updated: 2024-08-06T09:13:09.804Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Terminal Upgrade Tool in the Pilot Below Deck Equipment (BDE) and OpenPort implementations on Iridium satellite terminals allows remote attackers to execute arbitrary code by uploading new firmware to TCP port 54321. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/578598
CVE ID: CVE-2014-0328 State: PUBLISHED Published: 2014-08-15T10:00:00 Last Updated: 2024-08-06T09:13:10.160Z Vendors: n/a Products: n/a Problem Types: n/a Description: The thraneLINK protocol implementation on Cobham devices does not verify firmware signatures, which allows attackers to execute arbitrary code by leveraging physical access or terminal access to send an SNMP request and a TFTP response. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/179732
CVE ID: CVE-2014-0329 State: PUBLISHED Published: 2014-02-04T02:00:00 Last Updated: 2024-08-06T09:13:10.183Z Vendors: n/a Products: n/a Problem Types: n/a Description: The TELNET service on the ZTE ZXV10 W300 router 2.1.0 has a hardcoded password ending with airocon for the admin account, which allows remote attackers to obtain administrative access by leveraging knowledge of the MAC address characters present at the beginning of the password. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/228886 - http://packetstormsecurity.com/files/125142/ZTE-ZXV10-W300-Hardcoded-Credentials.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/90958
com/files/125142/ZTE-ZXV10-W300-Hardcoded-Credentials.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/90958 - http://osvdb.org/102816 - http://blog.alguien.at/2014/02/hackeando-el-router-zte-zxv10-w300-v21.html - http://www.securityfocus.com/bid/65310
CVE ID: CVE-2014-0330 State: PUBLISHED Published: 2014-02-06T23:00:00 Last Updated: 2024-08-06T09:13:09.993Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in adminui/user_list.php on the Dell KACE K1000 management appliance 5.5.90545 allows remote attackers to inject arbitrary web script or HTML via the LABEL_ID parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/65333 - http://osvdb.org/102855 - https://exchange.xforce.ibmcloud.com/vulnerabilities/90954 - http://www.kb.cert.org/vuls/id/813382
CVE ID: CVE-2014-0331 State: PUBLISHED Published: 2014-04-10T14:00:00 Last Updated: 2024-08-06T09:13:09.829Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the web administration interface in FortiADC with firmware before 3.2.1 allows remote attackers to inject arbitrary web script or HTML via the locale parameter to gui_partA/. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/667340 - http://www.securitytracker.com/id/1030018 - http://www.securityfocus.com/bid/66642 - http://seclists.org/fulldisclosure/2014/Apr/53 - http://www.fortiguard.com/advisory/FG-IR-14-004
CVE ID: CVE-2014-0332 State: PUBLISHED Published: 2014-02-14T16:00:00 Last Updated: 2024-08-06T09:13:09.580Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in mainPage in Dell SonicWALL GMS before 7.1 SP2, SonicWALL Analyzer before 7.1 SP2, and SonicWALL UMA E5000 before 7.1 SP2 might allow remote attackers to inject arbitrary web script or HTML via the node_id parameter in a ScreenDisplayManager genNetwork action. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/65498 - http://www.kb.cert.org/vuls/id/727318 - https://exchange.xforce.ibmcloud.com/vulnerabilities/91062 - http://osvdb.org/1032
tp://www.kb.cert.org/vuls/id/727318 - https://exchange.xforce.ibmcloud.com/vulnerabilities/91062 - http://osvdb.org/103216 - http://www.sonicwall.com/us/shared/download/Support_Bulletin_GMS_Vulnerability_XSS_Resolved_in_7.1_SP2_and_7.2.pdf
CVE ID: CVE-2014-0333 State: PUBLISHED Published: 2014-02-27T20:00:00 Last Updated: 2024-08-06T09:13:10.390Z Vendors: n/a Products: n/a Problem Types: n/a Description: The png_push_read_chunk function in pngpread.c in the progressive decoder in libpng 1.6.x through 1.6.9 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via an IDAT chunk with a length of zero. Additional Analyst Notes: - CVE Program Container: References: - ftp://ftp.simplesystems.org/pub/png/src/libpng16/patch-libpng16-vu684412.diff - https://sourceforge.net/projects/libpng/files/libpng16/patch-libpng16-vu684412.diff - http://lists.opensuse.org/opensuse-updates/2014-03/msg00029.html -
libpng/files/libpng16/patch-libpng16-vu684412.diff - http://lists.opensuse.org/opensuse-updates/2014-03/msg00029.html - http://www.kb.cert.org/vuls/id/684412
CVE ID: CVE-2014-0334 State: PUBLISHED Published: 2014-03-02T17:00:00 Last Updated: 2024-08-06T09:13:09.747Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in CMS Made Simple allow remote authenticated users to inject arbitrary web script or HTML via (1) the group parameter to admin/addgroup.php, (2) the htmlblob parameter to admin/addhtmlblob.php, the (3) title or (4) url parameter to admin/addbookmark.php, (5) the stylesheet_name parameter to admin/copystylesheet.php, (6) the template_name parameter to admin/copytemplate.php, the (7) title or (8) url parameter to admin/editbookmark.php, (9) the template parameter to admin/list
copytemplate.php, the (7) title or (8) url parameter to admin/editbookmark.php, (9) the template parameter to admin/listtemplates.php, or (10) the css_name parameter to admin/listcss.php, a different issue than CVE-2014-2092. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/65898 - http://www.kb.cert.org/vuls/id/526062
CVE ID: CVE-2014-0335 State: PUBLISHED Published: 2014-03-06T11:00:00 Last Updated: 2024-08-06T09:13:09.769Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the web client in Serena Dimensions CM 12.2 build 7.199.0 allow remote attackers to inject arbitrary web script or HTML via the (1) DB_CONN, (2) DB_NAME, (3) DM_HOST, (4) MAN_DB_NAME, (5) framecmd, (6) identifier, (7) merant.adm.adapters.AdmDialogPropertyMgr, (8) nav_frame, (9) nav_jsp, (10) target_frame, (11) id, or (12) type parameter to the dimensions/ URI. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/823452
CVE ID: CVE-2014-0336 State: PUBLISHED Published: 2014-03-06T11:00:00 Last Updated: 2024-08-06T09:13:09.892Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in the web client in Serena Dimensions CM 12.2 build 7.199.0 allows remote attackers to hijack the authentication of administrators for requests that use the user_new_master parameter to the adminconsole/ URI. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/823452
CVE ID: CVE-2014-0337 State: PUBLISHED Published: 2014-04-05T01:00:00 Last Updated: 2024-08-06T09:13:10.293Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the web interface on Huawei Echo Life HG8247 routers with software before V100R006C00SPC127 allows remote attackers to inject arbitrary web script or HTML via an invalid TELNET connection attempt with a crafted username that is not properly handled during construction of the "failed log-in attempts over telnet" log view. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/917700
CVE ID: CVE-2014-0338 State: PUBLISHED Published: 2014-03-16T10:00:00 Last Updated: 2024-08-06T09:13:09.841Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the firewall policy management pages in WatchGuard Fireware XTM before 11.8.3 allow remote attackers to inject arbitrary web script or HTML via the pol_name parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1029924 - http://www.kb.cert.org/vuls/id/807134 - http://watchguardsecuritycenter.com/2014/03/13/fireware-xtm-11-8-3-update-corrects-xss-flaw/ - http://seclists.org/fulldisclosure/2014/Mar/154 - http://www.secu
/03/13/fireware-xtm-11-8-3-update-corrects-xss-flaw/ - http://seclists.org/fulldisclosure/2014/Mar/154 - http://www.securityfocus.com/bid/66210
CVE ID: CVE-2014-0339 State: PUBLISHED Published: 2014-03-16T10:00:00 Last Updated: 2024-08-06T09:13:09.939Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in view.cgi in Webmin before 1.680 allows remote attackers to inject arbitrary web script or HTML via the search parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.webmin.com/changes.html - http://seclists.org/fulldisclosure/2014/Mar/274 - http://www.kb.cert.org/vuls/id/381692 - http://www-01.ibm.com/support/docview.wss?uid=swg21679713 - http://www.securityfocus.com/bid/66248
CVE ID: CVE-2014-0341 State: PUBLISHED Published: 2014-04-15T10:00:00 Last Updated: 2024-08-06T09:13:10.326Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in PivotX before 2.3.9 allow remote authenticated users to inject arbitrary web script or HTML via the title field to (1) templates_internal/pages.tpl, (2) templates_internal/home.tpl, or (3) templates_internal/entries.tpl; (4) an event field to objects.php; or the (5) email or (6) nickname field to pages.php, related to templates_internal/users.tpl. Additional Analyst Notes: - CVE Program Container: References: - http://sourceforge.net/p/pivot-weblog/code/4349/ - http://blog
nal Analyst Notes: - CVE Program Container: References: - http://sourceforge.net/p/pivot-weblog/code/4349/ - http://blog.pivotx.net/archive/2014/03/03/pivotx-239-released - http://www.securityfocus.com/bid/66800 - http://pivotx.net/page/security - http://sourceforge.net/p/pivot-weblog/code/4345/ - http://www.kb.cert.org/vuls/id/901156
CVE ID: CVE-2014-0342 State: PUBLISHED Published: 2014-04-15T10:00:00 Last Updated: 2024-08-06T09:13:09.835Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple unrestricted file upload vulnerabilities in fileupload.php in PivotX before 2.3.9 allow remote authenticated users to execute arbitrary PHP code by uploading a file with a (1) .php or (2) .php# extension, and then accessing it via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://blog.pivotx.net/archive/2014/03/03/pivotx-239-released - http://sourceforge.net/p/pivot-weblog/code/4347/ - http://pivotx.net/page/security - http://www.kb.cert.org/vuls/id/901156
CVE ID: CVE-2014-0343 State: PUBLISHED Published: 2014-03-25T20:00:00 Last Updated: 2024-08-06T09:13:10.285Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web interface on Virtual Access GW6110A routers with software 9.00 before 9.09.27, 9.50 before 9.50.21, and 10.00 before 10.00.21 allows remote authenticated users to gain privileges via a modified JavaScript variable. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/213046
CVE ID: CVE-2014-0344 State: PUBLISHED Published: 2014-03-29T20:00:00 Last Updated: 2024-08-06T09:13:09.855Z Vendors: n/a Products: n/a Problem Types: n/a Description: Properties.do in ZOHO ManageEngine OpStor before build 8500 does not properly check privilege levels, which allows remote authenticated users to obtain Admin access by using the name parameter in conjunction with a true value of the edit parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/66499 - http://www.kb.cert.org/vuls/id/140886
CVE ID: CVE-2014-0346 State: REJECTED Published: 2014-04-07T22:00:00 Last Updated: 2014-04-07T22:57:00 Description: No description available.
CVE ID: CVE-2014-0347 State: PUBLISHED Published: 2014-04-12T01:00:00 Last Updated: 2024-08-06T09:13:10.191Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Settings module in Websense Triton Unified Security Center 7.7.3 before Hotfix 31, Web Filter 7.7.3 before Hotfix 31, Web Security 7.7.3 before Hotfix 31, Web Security Gateway 7.7.3 before Hotfix 31, and Web Security Gateway Anywhere 7.7.3 before Hotfix 31 allows remote authenticated users to read cleartext passwords by replacing type="password" with type="text" in an INPUT element in the (1) Log Database or (2) User Directories component. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.
or (2) User Directories component. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/568252 - https://www.websense.com/content/mywebsense-hotfixes.aspx?patchid=894&prodidx=20&osidx=0&intidx=0&versionidx=0
CVE ID: CVE-2014-0348 State: PUBLISHED Published: 2014-04-15T10:00:00 Last Updated: 2024-08-06T09:13:10.268Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Artiva Agency Single Sign-On (SSO) implementation in Artiva Workstation 1.3.x before 1.3.9, Artiva Rm 3.1 MR7, Artiva Healthcare 5.2 MR5, and Artiva Architect 3.2 MR5, when the domain-name option is enabled, allows remote attackers to login to arbitrary domain accounts by using the corresponding username on a Windows client machine. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/215284
CVE ID: CVE-2014-0349 State: PUBLISHED Published: 2014-04-12T01:00:00 Last Updated: 2024-08-06T09:13:09.834Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple unspecified vulnerabilities in J2k-Codec allow remote attackers to execute arbitrary code via a crafted JPEG 2000 file. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/345337
CVE ID: CVE-2014-0350 State: PUBLISHED Published: 2014-04-26T01:00:00 Last Updated: 2024-08-06T09:13:09.667Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Poco::Net::X509Certificate::verify method in the NetSSL library in POCO C++ Libraries before 1.4.6p4 allows man-in-the-middle attackers to spoof SSL servers via crafted DNS PTR records that are requested during comparison of a server name to a wildcard domain name in an X.509 certificate. Additional Analyst Notes: - CVE Program Container: References: - http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177573.html - http://www.kb.cert.org/vuls/id/118748 - https://raw.githubusercontent.com/pocoproject/p
unce/2016-February/177573.html - http://www.kb.cert.org/vuls/id/118748 - https://raw.githubusercontent.com/pocoproject/poco/poco-1.4.6p4-release/CHANGELOG - http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177471.html
CVE ID: CVE-2014-0351 State: PUBLISHED Published: 2014-09-10T18:00:00 Last Updated: 2024-08-06T09:13:10.412Z Vendors: n/a Products: n/a Problem Types: n/a Description: The FortiManager protocol service in Fortinet FortiOS before 4.3.16 and 5.x before 5.0.8 on FortiGate devices does not prevent use of anonymous ciphersuites, which makes it easier for man-in-the-middle attackers to obtain sensitive information or interfere with communications by modifying the client-server data stream. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/96119 - http://www.securityfocus.com/bid/69754 - http://www.fortiguard.com/advisory/FG-IR-14-
mcloud.com/vulnerabilities/96119 - http://www.securityfocus.com/bid/69754 - http://www.fortiguard.com/advisory/FG-IR-14-006/ - http://www.kb.cert.org/vuls/id/730964
CVE ID: CVE-2014-0352 State: REJECTED Published: 2014-09-10T18:00:00 Last Updated: 2014-09-10T18:57:01 Description: No description available.
CVE ID: CVE-2014-0353 State: PUBLISHED Published: 2014-04-15T10:00:00 Last Updated: 2024-08-06T09:13:10.242Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00(BFQ.6)C0 allows remote attackers to bypass authentication by using %2F sequences in place of / (slash) characters. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/939260
CVE ID: CVE-2014-0354 State: PUBLISHED Published: 2014-04-15T10:00:00 Last Updated: 2024-08-06T09:13:10.359Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00(BFQ.6)C0 has a hardcoded password of qweasdzxc for an unspecified account, which allows remote attackers to obtain index.asp login access via an HTTP request. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/939260
CVE ID: CVE-2014-0355 State: PUBLISHED Published: 2014-04-15T10:00:00 Last Updated: 2024-08-06T09:13:10.405Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple stack-based buffer overflows on the ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00(BFQ.6)C0 allow man-in-the-middle attackers to execute arbitrary code via (1) a long temp attribute in a yweather:condition element in a forecastrss file that is processed by the checkWeather function; the (2) WeatherCity or (3) WeatherDegree variable to the detectWeather function; unspecified input to the (4) UpnpAddRunRLQoS, (5) UpnpDeleteRunRLQoS, or (6) UpnpDeletePortCheckType function; or (7) the SET COUNTRY udps comm
e (4) UpnpAddRunRLQoS, (5) UpnpDeleteRunRLQoS, or (6) UpnpDeletePortCheckType function; or (7) the SET COUNTRY udps command. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/939260