Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2014-9260 State: PUBLISHED Published: 2017-08-07T17:00:00 Last Updated: 2024-08-06T13:40:24.827Z Vendors: n/a Products: n/a Problem Types: n/a Description: The basic_settings function in the download manager plugin for WordPress before 2.7.3 allows remote authenticated users to update every WordPress option. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/130690/WordPress-Download-Manager-2.7.2-Privilege-Escalation.html
CVE ID: CVE-2014-9261 State: PUBLISHED Published: 2015-03-23T16:00:00 Last Updated: 2024-08-06T13:40:24.915Z Vendors: n/a Products: n/a Problem Types: n/a Description: The sanitize function in Codoforum 2.5.1 does not properly implement filtering for directory traversal sequences, which allows remote attackers to read arbitrary files via a .. (dot dot) in the path parameter to index.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/130739/Codoforum-2.5.1-Arbitrary-File-Download.html - http://osvdb.org/show/osvdb/119412 - http://www.exploit-db.com/exploits/36320 - https://codoforum.com/documentation/roadmap - http://security.szurek.pl/c
2 - http://www.exploit-db.com/exploits/36320 - https://codoforum.com/documentation/roadmap - http://security.szurek.pl/codoforum-251-arbitrary-file-download.html
CVE ID: CVE-2014-9262 State: PUBLISHED Published: 2017-08-07T17:00:00 Last Updated: 2024-08-06T13:40:24.994Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Duplicator plugin in Wordpress before 0.5.10 allows remote authenticated users to create and download backup files. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/36112/
CVE ID: CVE-2014-9263 State: PUBLISHED Published: 2014-12-08T16:00:00 Last Updated: 2024-08-06T13:40:24.558Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple buffer overflows in the PocketNetNVRMediaClientAxCtrl.NVRMediaViewer.1 control in 3S Pocketnet Tech VMS allow remote attackers to execute arbitrary code via a crafted string to the (1) StartRecord, (2) StartRecordEx, (3) StartScheduledRecord, (4) SetDisplayText, (5) GetONVIFDeviceInformation, (6) GetONVIFProfiles, or (7) GetONVIFStreamUri method or a crafted filename to the (8) SaveCurrentImage or (9) SaveCurrentImageEx method. Additional Analyst Notes: - CVE Program Container: References: - http://www.zerodayinitiati
) SaveCurrentImageEx method. Additional Analyst Notes: - CVE Program Container: References: - http://www.zerodayinitiative.com/advisories/ZDI-14-397/ - http://www.zerodayinitiative.com/advisories/ZDI-14-396/ - http://www.zerodayinitiative.com/advisories/ZDI-14-395/ - http://www.zerodayinitiative.com/advisories/ZDI-14-394/ - http://www.zerodayinitiative.com/advisories/ZDI-14-393/ - http://www.securityfocus.com/bid/71488
CVE ID: CVE-2014-9264 State: PUBLISHED Published: 2014-12-11T15:00:00 Last Updated: 2024-08-06T13:40:25.127Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in the .NET Data Provider in SAP SQL Anywhere allows remote attackers to execute arbitrary code via a crafted column alias. Additional Analyst Notes: - CVE Program Container: References: - http://www.zerodayinitiative.com/advisories/ZDI-14-413/ - http://www.zerodayinitiative.com/advisories/ZDI-14-412/ - http://www.zerodayinitiative.com/advisories/ZDI-14-414/ - http://www.zerodayinitiative.com/advisories/ZDI-14-415/
CVE ID: CVE-2014-9265 State: PUBLISHED Published: 2014-12-08T16:00:00 Last Updated: 2024-08-06T13:40:25.150Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in the BackupToAvi method in the CNC_Ctrl ActiveX control in Samsung SmartViewer allows remote attackers to execute arbitrary code via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/71486 - http://www.zerodayinitiative.com/advisories/ZDI-14-401/
CVE ID: CVE-2014-9266 State: PUBLISHED Published: 2014-12-08T16:00:00 Last Updated: 2024-08-06T13:40:24.809Z Vendors: n/a Products: n/a Problem Types: n/a Description: The STWConfig ActiveX control in Samsung SmartViewer does not properly initialize a variable, which allows remote attackers to execute arbitrary code via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.zerodayinitiative.com/advisories/ZDI-14-400/ - http://www.securityfocus.com/bid/71489
CVE ID: CVE-2014-9267 State: PUBLISHED Published: 2014-12-08T16:00:00 Last Updated: 2024-08-06T13:40:24.097Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in the PTC IsoView ActiveX control allows remote attackers to execute arbitrary code via a crafted ViewPort property value. Additional Analyst Notes: - CVE Program Container: References: - http://www.zerodayinitiative.com/advisories/ZDI-14-398/ - http://www.securityfocus.com/bid/71491 - https://support.ptc.com/appserver/cs/view/solution.jsp?n=CS181001 - http://www.zerodayinitiative.com/advisories/ZDI-14-399/
CVE ID: CVE-2014-9268 State: PUBLISHED Published: 2014-12-08T16:00:00 Last Updated: 2024-08-06T13:40:24.792Z Vendors: n/a Products: n/a Problem Types: n/a Description: The AdView.AdViewer.1 ActiveX control in Autodesk Design Review (ADR) before 2013 Hotfix 1 allows remote attackers to execute arbitrary code via a crafted DWF file. Additional Analyst Notes: - CVE Program Container: References: - http://knowledge.autodesk.com/support/design-review/downloads/caas/downloads/content/autodesk-design-review-2013-hotfix.html - http://www.zerodayinitiative.com/advisories/ZDI-14-402/
CVE ID: CVE-2014-9269 State: PUBLISHED Published: 2015-01-09T18:00:00 Last Updated: 2024-08-06T13:40:24.867Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in helper_api.php in MantisBT 1.1.0a1 through 1.2.x before 1.2.18, when Extended project browser is enabled, allows remote attackers to inject arbitrary web script or HTML via the project cookie. Additional Analyst Notes: - CVE Program Container: References: - https://www.mantisbt.org/bugs/view.php?id=17890 - https://github.com/mantisbt/mantisbt/commit/511564cc - http://secunia.com/advisories/62101 - http://seclists.org/oss-sec/2014/q4/867 - http://seclists.org/oss-sec/2014/q4/902 - htt
//secunia.com/advisories/62101 - http://seclists.org/oss-sec/2014/q4/867 - http://seclists.org/oss-sec/2014/q4/902 - http://www.debian.org/security/2015/dsa-3120
CVE ID: CVE-2014-9270 State: PUBLISHED Published: 2014-12-08T16:00:00 Last Updated: 2024-08-06T13:40:24.819Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the projax_array_serialize_for_autocomplete function in core/projax_api.php in MantisBT 1.1.0a3 through 1.2.17 allows remote attackers to inject arbitrary web script or HTML via the "profile/Platform" field. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/71372 - https://exchange.xforce.ibmcloud.com/vulnerabilities/99037 - https://www.mantisbt.org/bugs/view.php?id=17583 - http://secunia.com/advisories/62101 - http://seclists.org/oss-s
9037 - https://www.mantisbt.org/bugs/view.php?id=17583 - http://secunia.com/advisories/62101 - http://seclists.org/oss-sec/2014/q4/867 - http://seclists.org/oss-sec/2014/q4/902 - https://github.com/mantisbt/mantisbt/commit/0bff06ec - http://www.debian.org/security/2015/dsa-3120
CVE ID: CVE-2014-9271 State: PUBLISHED Published: 2015-01-09T18:00:00 Last Updated: 2024-08-06T13:40:25.100Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in file_download.php in MantisBT before 1.2.18 allows remote authenticated users to inject arbitrary web script or HTML via a Flash file with an image extension, related to inline attachments, as demonstrated by a .swf.jpeg filename. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/62101 - http://seclists.org/oss-sec/2014/q4/867 - https://www.mantisbt.org/bugs/view.php?id=17874 - http://seclists.org/oss-sec/2014/q4/902 - http://seclists.org/
4/867 - https://www.mantisbt.org/bugs/view.php?id=17874 - http://seclists.org/oss-sec/2014/q4/902 - http://seclists.org/oss-sec/2014/q4/924 - https://github.com/mantisbt/mantisbt/commit/9fb8cf36f - http://www.debian.org/security/2015/dsa-3120
CVE ID: CVE-2014-9272 State: PUBLISHED Published: 2015-01-09T18:00:00 Last Updated: 2024-08-06T13:40:24.349Z Vendors: n/a Products: n/a Problem Types: n/a Description: The string_insert_href function in MantisBT 1.2.0a1 through 1.2.x before 1.2.18 does not properly validate the URL protocol, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the javascript:// protocol. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mantisbt/mantisbt/commit/05378e00 - https://www.mantisbt.org/bugs/view.php?id=17297 - http://secunia.com/advisories/62101 - http://seclists.org/oss-sec/2014/q4/867 - http://seclists.org/oss-sec/2014/q4/902 - http://
cunia.com/advisories/62101 - http://seclists.org/oss-sec/2014/q4/867 - http://seclists.org/oss-sec/2014/q4/902 - http://www.debian.org/security/2015/dsa-3120
CVE ID: CVE-2014-9273 State: PUBLISHED Published: 2014-12-08T16:00:00 Last Updated: 2024-08-06T13:40:23.894Z Vendors: n/a Products: n/a Problem Types: n/a Description: lib/handle.c in Hivex before 1.3.11 allows local users to execute arbitrary code and gain privileges via a small hive files, which triggers an out-of-bounds read or write. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201503-07 - https://github.com/libguestfs/hivex/commit/4bbdf555f88baeae0fa804a369a81a83908bd705 - http://lists.opensuse.org/opensuse-updates/2015-02/msg00005.html - http://www.securityfocus.com/bid/71279 - http://www.openwall.com/lists/oss-security/2014/12/04/14
015-02/msg00005.html - http://www.securityfocus.com/bid/71279 - http://www.openwall.com/lists/oss-security/2014/12/04/14 - https://bugzilla.redhat.com/show_bug.cgi?id=1167756 - http://rhn.redhat.com/errata/RHSA-2015-0301.html - https://github.com/libguestfs/hivex/commit/357f26fa64fd1d9ccac2331fe174a8ee9c607adb - http://www.openwall.com/lists/oss-security/2014/11/25/6 - https://www.redhat.com/archives/libguestfs/2014-October/msg00235.html - http://rhn.redhat.com/errata/RHSA-2015-1378.html - http://secunia.com/advisories/62792
CVE ID: CVE-2014-9274 State: PUBLISHED Published: 2014-12-09T22:52:00 Last Updated: 2024-08-06T13:40:24.592Z Vendors: n/a Products: n/a Problem Types: n/a Description: UnRTF allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code as demonstrated by a file containing the string "{\cb-999999999". Additional Analyst Notes: - CVE Program Container: References: - http://advisories.mageia.org/MGASA-2014-0533.html - http://secunia.com/advisories/62811 - http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147399.html - http://www.openwall.com/lists/oss-security/2014/12/04/15 - http://www.debian.org/security/2015/dsa-3158 - http://www.mandri
p://www.openwall.com/lists/oss-security/2014/12/04/15 - http://www.debian.org/security/2015/dsa-3158 - http://www.mandriva.com/security/advisories?name=MDVSA-2015:007 - http://www.securityfocus.com/bid/71430 - https://lists.gnu.org/archive/html/bug-unrtf/2014-11/msg00001.html - https://security.gentoo.org/glsa/201507-06 - https://bugzilla.redhat.com/show_bug.cgi?id=1170233
CVE ID: CVE-2014-9275 State: PUBLISHED Published: 2014-12-09T22:52:00 Last Updated: 2024-08-06T13:40:24.907Z Vendors: n/a Products: n/a Problem Types: n/a Description: UnRTF allows remote attackers to cause a denial of service (out-of-bounds memory access and crash) and possibly execute arbitrary code via a crafted RTF file. Additional Analyst Notes: - CVE Program Container: References: - http://advisories.mageia.org/MGASA-2014-0533.html - http://secunia.com/advisories/62811 - http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147399.html - http://www.openwall.com/lists/oss-security/2014/12/04/15 - http://www.openwall.com/lists/oss-security/2014/12/03/4 - http://www.debia
enwall.com/lists/oss-security/2014/12/04/15 - http://www.openwall.com/lists/oss-security/2014/12/03/4 - http://www.debian.org/security/2015/dsa-3158 - http://www.mandriva.com/security/advisories?name=MDVSA-2015:007 - http://www.securityfocus.com/bid/71506 - https://security.gentoo.org/glsa/201507-06 - https://bugzilla.redhat.com/show_bug.cgi?id=1170233
CVE ID: CVE-2014-9276 State: PUBLISHED Published: 2015-01-04T21:00:00 Last Updated: 2024-08-06T13:40:24.980Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in the Special:ExpandedTemplates page in MediaWiki before 1.19.22, 1.20.x through 1.22.x before 1.22.14, and 1.23.x before 1.23.7, when $wgRawHTML is set to true, allows remote attackers to hijack the authentication of users with edit permissions for requests that cross-site scripting (XSS) attacks via the wpInput parameter, which is not properly handled in the preview. Additional Analyst Notes: - CVE Program Container: References: - http://securitytracker.com/id?1031301 - http:/
preview. Additional Analyst Notes: - CVE Program Container: References: - http://securitytracker.com/id?1031301 - http://www.openwall.com/lists/oss-security/2014/12/03/9 - http://www.openwall.com/lists/oss-security/2014/12/04/16 - https://phabricator.wikimedia.org/T73111 - https://lists.wikimedia.org/pipermail/mediawiki-announce/2014-November/000170.html
CVE ID: CVE-2014-9277 State: PUBLISHED Published: 2015-01-04T21:00:00 Last Updated: 2024-08-06T13:40:24.904Z Vendors: n/a Products: n/a Problem Types: n/a Description: The wfMangleFlashPolicy function in OutputHandler.php in MediaWiki before 1.19.22, 1.20.x through 1.22.x before 1.22.14, and 1.23.x before 1.23.7 allows remote attackers to conduct PHP object injection attacks via a crafted string containing <cross-domain-policy> in a PHP format request, which causes the string length to change when converting the request to <NOT-cross-domain-policy>. Additional Analyst Notes: - CVE Program Container: References: - http://securitytracker.com/id?1031301 - https://phabricator.wikimedia.org/T7347
: - CVE Program Container: References: - http://securitytracker.com/id?1031301 - https://phabricator.wikimedia.org/T73478 - http://www.openwall.com/lists/oss-security/2014/12/03/9 - http://www.openwall.com/lists/oss-security/2014/12/04/16 - http://www.debian.org/security/2014/dsa-3100 - https://lists.wikimedia.org/pipermail/mediawiki-announce/2014-November/000170.html
CVE ID: CVE-2014-9278 State: PUBLISHED Published: 2014-12-06T15:00:00 Last Updated: 2024-08-06T13:40:25.092Z Vendors: n/a Products: n/a Problem Types: n/a Description: The OpenSSH server, as used in Fedora and Red Hat Enterprise Linux 7 and when running in a Kerberos environment, allows remote authenticated users to log in as another user when they are listed in the .k5users file of that user, which might bypass intended authentication requirements that would force a local login. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/71420 - http://www.openwall.com/lists/oss-security/2014/12/04/17 - http://rhn.redhat.com/errata/RHSA-2015-0425.html -
id/71420 - http://www.openwall.com/lists/oss-security/2014/12/04/17 - http://rhn.redhat.com/errata/RHSA-2015-0425.html - https://bugzilla.redhat.com/show_bug.cgi?id=1169843 - https://bugzilla.mindrot.org/show_bug.cgi?id=1867 - http://thread.gmane.org/gmane.comp.encryption.kerberos.general/15855 - https://exchange.xforce.ibmcloud.com/vulnerabilities/99090 - http://www.openwall.com/lists/oss-security/2014/12/02/3
CVE ID: CVE-2014-9279 State: PUBLISHED Published: 2014-12-08T16:00:00 Last Updated: 2024-08-06T13:40:25.094Z Vendors: n/a Products: n/a Problem Types: n/a Description: The print_test_result function in admin/upgrade_unattended.php in MantisBT 1.1.0a3 through 1.2.x before 1.2.18 allows remote attackers to obtain database credentials via a URL in the hostname parameter and reading the parameters in the response sent to the URL. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/71359 - https://github.com/mantisbt/mantisbt/commit/0826cef8 - http://www.mantisbt.org/bugs/view.php?id=17877 - http://seclists.org/oss-sec/2014/q4/863 - https://exchange.x
0826cef8 - http://www.mantisbt.org/bugs/view.php?id=17877 - http://seclists.org/oss-sec/2014/q4/863 - https://exchange.xforce.ibmcloud.com/vulnerabilities/99031
CVE ID: CVE-2014-9280 State: PUBLISHED Published: 2014-12-08T16:00:00 Last Updated: 2024-08-06T13:40:24.964Z Vendors: n/a Products: n/a Problem Types: n/a Description: The current_user_get_bug_filter function in core/current_user_api.php in MantisBT before 1.2.18 allows remote attackers to execute arbitrary PHP code via the filter parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/71361 - http://www.mantisbt.org/bugs/view.php?id=17875 - https://github.com/mantisbt/mantisbt/commit/599364b2 - http://seclists.org/oss-sec/2014/q4/923 - https://exchange.xforce.ibmcloud.com/vulnerabilities/99016 - http://secunia.com/advisories/62101 - http:
c/2014/q4/923 - https://exchange.xforce.ibmcloud.com/vulnerabilities/99016 - http://secunia.com/advisories/62101 - http://www.debian.org/security/2015/dsa-3120 - http://seclists.org/oss-sec/2014/q4/864
CVE ID: CVE-2014-9281 State: PUBLISHED Published: 2014-12-09T22:52:00 Last Updated: 2024-08-06T13:40:24.996Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in admin/copy_field.php in MantisBT before 1.2.18 allows remote attackers to inject arbitrary web script or HTML via the dest_id field. Additional Analyst Notes: - CVE Program Container: References: - https://www.mantisbt.org/bugs/view.php?id=17876 - http://seclists.org/oss-sec/2014/q4/913 - https://github.com/mantisbt/mantisbt/commit/e5fc835a - http://www.securityfocus.com/bid/71371 - http://secunia.com/advisories/62101 - http://seclists.org/oss-sec/2014/q4/867 - http://seclists.org/os
s.com/bid/71371 - http://secunia.com/advisories/62101 - http://seclists.org/oss-sec/2014/q4/867 - http://seclists.org/oss-sec/2014/q4/924 - http://www.debian.org/security/2015/dsa-3120 - https://exchange.xforce.ibmcloud.com/vulnerabilities/99038
CVE ID: CVE-2014-9282 State: PUBLISHED Published: 2015-02-24T20:00:00 Last Updated: 2024-08-06T13:40:25.040Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the Speed Root Explorer application before 3.2 for Android and the Speed Explorer application before 2.2 for Android allows remote attackers to write to arbitrary files via a crafted filename. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN42768331/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000023
CVE ID: CVE-2014-9283 State: PUBLISHED Published: 2015-03-03T11:00:00 Last Updated: 2024-08-06T13:40:25.057Z Vendors: n/a Products: n/a Problem Types: n/a Description: The BestWebSoft Captcha plugin before 4.0.7 for WordPress allows remote attackers to bypass the CAPTCHA protection mechanism and obtain administrative access via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN93727681/index.html - https://wordpress.org/plugins/captcha/changelog/ - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000029
CVE ID: CVE-2014-9284 State: PUBLISHED Published: 2015-06-09T00:00:00 Last Updated: 2024-08-06T13:40:24.887Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Buffalo WHR-1166DHP 1.60 and earlier, WSR-600DHP 1.60 and earlier, WHR-600D 1.60 and earlier, WHR-300HP2 1.60 and earlier, WMR-300 1.60 and earlier, WEX-300 1.60 and earlier, and BHR-4GRV2 1.04 and earlier routers allow remote authenticated users to execute arbitrary OS commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN50447904/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000085
CVE ID: CVE-2014-9285 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2014-9286 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2014-9287 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2014-9288 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2014-9289 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2014-9290 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2014-9291 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2014-9292 State: PUBLISHED Published: 2014-12-05T22:00:00Z Last Updated: 2024-09-17T02:11:35.009Z Vendors: n/a Products: n/a Problem Types: n/a Description: Server-side request forgery (SSRF) vulnerability in proxy.php in the jRSS Widget plugin 1.2 and earlier for WordPress allows remote attackers to trigger outbound requests and enumerate open ports via the url parameter. Additional Analyst Notes: - CVE Program Container: References: - http://codevigilant.com/disclosure/wp-plugin-jrss-widget-ssrfxspa/
CVE ID: CVE-2014-9293 State: PUBLISHED Published: 2014-12-20T02:00:00 Last Updated: 2024-08-06T13:40:25.037Z Vendors: n/a Products: n/a Problem Types: n/a Description: The config_auth function in ntpd in NTP before 4.2.7p11, when an auth key is not configured, improperly generates a key, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack. Additional Analyst Notes: - CVE Program Container: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20141222-ntpd - http://marc.info/?l=bugtraq&m=142590659431171&w=2 - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c0479
/?l=bugtraq&m=142590659431171&w=2 - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04790232 - https://kc.mcafee.com/corporate/index?page=content&id=SB10103 - http://advisories.mageia.org/MGASA-2014-0541.html - http://www.kb.cert.org/vuls/id/852879 - http://marc.info/?l=bugtraq&m=142853370924302&w=2 - http://rhn.redhat.com/errata/RHSA-2014-2025.html - http://secunia.com/advisories/62209 - http://bugs.ntp.org/show_bug.cgi?id=2665 - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html - http://rhn.redhat.com/errata/RHSA-2015-0104.html - http://marc.info/?l=bugtraq&m=144182594518755&w=2 - http://marc.info/?l=bugtraq&m=142853370924302&w=2 -
015-0104.html - http://marc.info/?l=bugtraq&m=144182594518755&w=2 - http://marc.info/?l=bugtraq&m=142853370924302&w=2 - http://support.ntp.org/bin/view/Main/SecurityNotice - http://marc.info/?l=bugtraq&m=142469153211996&w=2 - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04916783 - http://bk1.ntp.org/ntp-dev/ntpd/ntp_config.c?PAGE=diffs&REV=4b6089c5KXhXqZqocF0DMXnQQsjOuw - http://www.mandriva.com/security/advisories?name=MDVSA-2015:003 - http://www.securityfocus.com/bid/71757 - https://bugzilla.redhat.com/show_bug.cgi?id=1176032 - https://www.arista.com/en/support/advisories-notices/security-advisories/1047-security-advisory-8