Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2014-8371 State: PUBLISHED Published: 2014-12-08T11:00:00 Last Updated: 2024-08-06T13:18:47.886Z Vendors: n/a Products: n/a Problem Types: n/a Description: VMware vCenter Server Appliance (vCSA) 5.5 before Update 2, 5.1 before Update 3, and 5.0 before Update 3c does not properly validate certificates when connecting to a CIM Server on an ESXi host, which allows man-in-the-middle attackers to spoof CIM servers via a crafted certificate. Additional Analyst Notes: - CVE Program Container: References: - http://www.vmware.com/security/advisories/VMSA-2014-0012.html - http://www.securityfocus.com/archive/1/534161/100/0/threaded - http://seclists.org/fulldisclosure/2014/Dec/23
CVE ID: CVE-2014-8372 State: PUBLISHED Published: 2014-12-11T15:00:00 Last Updated: 2024-08-06T13:18:48.289Z Vendors: n/a Products: n/a Problem Types: n/a Description: AirWatch by VMware On-Premise 7.3.x before 7.3.3.0 (FP3) allows remote authenticated users to obtain the organizational information and statistics from arbitrary tenants via vectors involving a direct object reference. Additional Analyst Notes: - CVE Program Container: References: - http://www.vmware.com/security/advisories/VMSA-2014-0014.html - http://seclists.org/fulldisclosure/2014/Dec/44
CVE ID: CVE-2014-8373 State: PUBLISHED Published: 2014-12-11T15:00:00 Last Updated: 2024-08-06T13:18:47.564Z Vendors: n/a Products: n/a Problem Types: n/a Description: The VMware Remote Console (VMRC) function in VMware vCloud Automation Center (vCAC) 6.0.1 through 6.1.1 allows remote authenticated users to gain privileges via vectors involving the "Connect (by) Using VMRC" function. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2014/Dec/33 - http://www.vmware.com/security/advisories/VMSA-2014-0013.html - http://secunia.com/advisories/61169 - http://packetstormsecurity.com/files/129455/VMware-Security-Advisory-2014-0013.html - http://www.
com/advisories/61169 - http://packetstormsecurity.com/files/129455/VMware-Security-Advisory-2014-0013.html - http://www.securityfocus.com/archive/1/534186/100/0/threaded - http://www.securitytracker.com/id/1031323
CVE ID: CVE-2014-8374 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2014-8375 State: PUBLISHED Published: 2014-10-21T14:00:00 Last Updated: 2024-08-06T13:18:48.452Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in GBgallery.php in the GB Gallery Slideshow plugin 1.5 for WordPress allows remote administrators to execute arbitrary SQL commands via the selected_group parameter in a gb_ajax_get_group action to wp-admin/admin-ajax.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/127833/WordPress-GB-Gallery-Slideshow-1.5-SQL-Injection.html - http://www.securityfocus.com/bid/69181 - http://www.homelab.it/index.php/2014/08/10/wordpress-gb-gallery-slideshow
CVE ID: CVE-2014-8376 State: PUBLISHED Published: 2014-10-21T15:00:00Z Last Updated: 2024-09-16T17:08:07.603Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the context administration sub-panel in the Site Banner module before 7.x-4.1 for Drupal allows remote authenticated users with the "Administer contexts" Context UI module permission to inject arbitrary web script or HTML via vectors related to context settings. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/60758 - https://www.drupal.org/node/2324303 - https://www.drupal.org/node/2324689 - http://www.securityfocus.com/bid/69343
CVE ID: CVE-2014-8377 State: PUBLISHED Published: 2014-10-21T15:00:00 Last Updated: 2024-08-06T13:18:48.104Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Webasyst Shop-Script 5.2.2.30933 allows remote attackers to inject arbitrary web script or HTML via the phone number field in a new contact to phpecom/index.php/webasyst/contacts/. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/127946/Webasyst-Shop-Script-5.2.2.30933-Cross-Site-Scripting.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/95414
CVE ID: CVE-2014-8378 State: PUBLISHED Published: 2014-10-21T15:00:00 Last Updated: 2024-08-06T13:18:47.842Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the TableField module 7.x-2.x before 7.x-2.3 allows remote authenticated users with the "administer content types" or "administer taxonomy" permission to inject arbitrary web script or HTML via vectors related to the field help text in an entity edit form. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/69227 - http://secunia.com/advisories/60688 - https://exchange.xforce.ibmcloud.com/vulnerabilities/95312 - https://www.drupal.org/nod
//secunia.com/advisories/60688 - https://exchange.xforce.ibmcloud.com/vulnerabilities/95312 - https://www.drupal.org/node/2320027 - https://www.drupal.org/node/2320613
CVE ID: CVE-2014-8379 State: PUBLISHED Published: 2014-10-21T15:00:00Z Last Updated: 2024-09-17T01:31:52.475Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the Marketo MA module before 7.x-1.5 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors related to field titles to the (1) Webform or (2) User sub-modules. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/node/2324813 - http://secunia.com/advisories/60734 - https://www.drupal.org/node/2324777 - http://www.securityfocus.com/bid/69340
CVE ID: CVE-2014-8380 State: PUBLISHED Published: 2014-10-21T15:00:00 Last Updated: 2024-08-06T13:18:48.313Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Splunk 6.1.1 allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer Header in a "404 Not Found" response. NOTE: this vulnerability might exist because of a CVE-2010-2429 regression. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/126813/Splunk-6.1.1-Cross-Site-Scripting.html - https://www.exploit-db.com/exploits/40997/ - http://www.securityfocus.com/bid/67655
CVE ID: CVE-2014-8381 State: PUBLISHED Published: 2014-10-22T14:00:00 Last Updated: 2024-08-06T13:18:48.064Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Megapolis.Portal Manager allow remote attackers to inject arbitrary web script or HTML via the (1) dateFrom or (2) dateTo parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/70615 - http://seclists.org/fulldisclosure/2014/Oct/77 - http://websecurity.com.ua/7398/ - https://exchange.xforce.ibmcloud.com/vulnerabilities/97649 - http://packetstormsecurity.com/files/128725/Megapolis.Portal-Manager-Cross-Site-Scripting.html
CVE ID: CVE-2014-8383 State: PUBLISHED Published: 2015-05-18T15:00:00 Last Updated: 2024-08-06T13:18:48.280Z Vendors: n/a Products: n/a Problem Types: n/a Description: The InFocus IN3128HD projector with firmware 0.26 allows remote attackers to bypass authentication via a direct request to main.html. Additional Analyst Notes: - CVE Program Container: References: - http://www.coresecurity.com/advisories/infocus-in3128hd-projector-multiple-vulnerabilities - http://packetstormsecurity.com/files/131661/InFocus-IN3128HD-Projector-Missing-Authentication.html - http://seclists.org/fulldisclosure/2015/Apr/88
CVE ID: CVE-2014-8384 State: PUBLISHED Published: 2015-05-18T15:00:00 Last Updated: 2024-08-06T13:18:47.963Z Vendors: n/a Products: n/a Problem Types: n/a Description: The InFocus IN3128HD projector with firmware 0.26 does not restrict access to cgi-bin/webctrl.cgi.elf, which allows remote attackers to modify the DHCP server and device IP configuration, reboot the device, change the device name, and have other unspecified impact via a crafted request. Additional Analyst Notes: - CVE Program Container: References: - http://www.coresecurity.com/advisories/infocus-in3128hd-projector-multiple-vulnerabilities - http://packetstormsecurity.com/files/131661/InFocus-IN3128HD-Projector-Missing-Authent
jector-multiple-vulnerabilities - http://packetstormsecurity.com/files/131661/InFocus-IN3128HD-Projector-Missing-Authentication.html - http://seclists.org/fulldisclosure/2015/Apr/88
CVE ID: CVE-2014-8385 State: PUBLISHED Published: 2015-02-13T02:00:00 Last Updated: 2024-08-06T13:18:47.915Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow on Advantech EKI-1200 gateways with firmware before 1.63 allows remote attackers to execute arbitrary code via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-15-041-01
CVE ID: CVE-2014-8386 State: PUBLISHED Published: 2015-01-20T15:00:00 Last Updated: 2024-08-06T13:18:48.123Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple stack-based buffer overflows in Advantech AdamView 4.3 and earlier allow remote attackers to execute arbitrary code via a crafted (1) display properties or (2) conditional bitmap parameter in a GNI file. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2014/Nov/57 - http://www.exploit-db.com/exploits/35503 - http://www.coresecurity.com/advisories/advantech-adamView-buffer-overflow
CVE ID: CVE-2014-8387 State: PUBLISHED Published: 2014-11-20T11:00:00 Last Updated: 2024-08-06T13:18:48.084Z Vendors: n/a Products: n/a Problem Types: n/a Description: cgi/utility.cgi in Advantech EKI-6340 2.05 Wi-Fi Mesh Access Point allows remote authenticated users to execute arbitrary commands via shell metacharacters in the pinghost parameter to ping.cgi. Additional Analyst Notes: - CVE Program Container: References: - http://www.coresecurity.com/advisories/advantech-eki-6340-command-injection - http://seclists.org/fulldisclosure/2014/Nov/58 - http://www.securityfocus.com/archive/1/534021/100/0/threaded - http://www.securityfocus.com/bid/71192
CVE ID: CVE-2014-8388 State: PUBLISHED Published: 2014-11-21T02:00:00 Last Updated: 2024-08-06T13:18:48.124Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in Advantech WebAccess, formerly BroadWin WebAccess, before 8.0 allows remote attackers to execute arbitrary code via a crafted ip_address parameter in an HTML document. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-14-324-01
CVE ID: CVE-2014-8389 State: PUBLISHED Published: 2017-12-27T18:00:00 Last Updated: 2024-08-06T13:18:48.069Z Vendors: n/a Products: n/a Problem Types: n/a Description: cgi-bin/mft/wireless_mft.cgi in AirLive BU-2015 with firmware 1.03.18 16.06.2014, AirLive BU-3026 with firmware 1.43 21.08.2014, AirLive MD-3025 with firmware 1.81 21.08.2014, AirLive WL-2000CAM with firmware LM.1.6.18 14.10.2011, and AirLive POE-200CAM v2 with firmware LM.1.6.17.01 uses hard-coded credentials in the embedded Boa web server, which allows remote attackers to obtain user credentials via crafted HTTP requests. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/
HTTP requests. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/535938/100/0/threaded - http://packetstormsecurity.com/files/132585/AirLive-Remote-Command-Injection.html - http://seclists.org/fulldisclosure/2015/Jul/29 - http://www.securityfocus.com/bid/75559 - https://www.coresecurity.com/advisories/airlive-multiple-products-os-command-injection
CVE ID: CVE-2014-8390 State: PUBLISHED Published: 2015-04-03T10:00:00 Last Updated: 2024-08-06T13:18:48.295Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple buffer overflows in Schneider Electric VAMPSET before 2.2.168 allow local users to gain privileges via malformed disturbance-recording data in a (1) CFG or (2) DAT file. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/535142/100/0/threaded - http://www.securityfocus.com/bid/73405 - http://www.coresecurity.com/advisories/schneider-vampset-stack-and-heap-buffer-overflow - https://ics-cert.us-cert.gov/advisories/ICSA-15-092-01 - http://www.schneider-electric.com/ww/
nd-heap-buffer-overflow - https://ics-cert.us-cert.gov/advisories/ICSA-15-092-01 - http://www.schneider-electric.com/ww/en/download/document/SEVD-2015-084-01
CVE ID: CVE-2014-8391 State: PUBLISHED Published: 2015-06-02T14:00:00 Last Updated: 2024-08-06T13:18:48.188Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Web interface in Sendio before 7.2.4 does not properly handle sessions, which allows remote authenticated users to obtain sensitive information from other users' sessions via a large number of requests. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2015/May/95 - http://packetstormsecurity.com/files/132022/Sendio-ESP-Information-Disclosure.html - http://www.securityfocus.com/archive/1/535592/100/0/threaded - https://www.exploit-db.com/exploits/37114/ - http://www.sendio.
/www.securityfocus.com/archive/1/535592/100/0/threaded - https://www.exploit-db.com/exploits/37114/ - http://www.sendio.com/software-release-history/
CVE ID: CVE-2014-8393 State: PUBLISHED Published: 2017-08-28T20:00:00 Last Updated: 2024-08-06T13:18:47.999Z Vendors: n/a Products: n/a Problem Types: n/a Description: DLL Hijacking vulnerability in CorelDRAW X7, Corel Photo-Paint X7, Corel PaintShop Pro X7, Corel Painter 2015, and Corel PDF Fusion. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/534452/100/0/threaded - http://www.securityfocus.com/bid/72005 - http://secunia.com/advisories/62210 - http://www.coresecurity.com/advisories/corel-software-dll-hijacking - http://www.securitytracker.com/id/1031522 - http://seclists.org/fulldisclosure/2015/Jan/33 - http://packetstormsecurity.co
tp://www.securitytracker.com/id/1031522 - http://seclists.org/fulldisclosure/2015/Jan/33 - http://packetstormsecurity.com/files/129922/Corel-Software-DLL-Hijacking.html
CVE ID: CVE-2014-8394 State: PUBLISHED Published: 2015-01-15T15:00:00 Last Updated: 2024-08-06T13:18:47.640Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple untrusted search path vulnerabilities in Corel CAD 2014 allow local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse (1) FxManagedCommands_3.08_9.tx or (2) TD_Mgd_3.08_9.dll file in the current working directory. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/534452/100/0/threaded - http://www.securityfocus.com/bid/72004 - http://www.coresecurity.com/advisories/corel-software-dll-hijacking - http://seclists.org/fulldisclosure/
om/bid/72004 - http://www.coresecurity.com/advisories/corel-software-dll-hijacking - http://seclists.org/fulldisclosure/2015/Jan/33
CVE ID: CVE-2014-8395 State: PUBLISHED Published: 2015-01-15T15:00:00 Last Updated: 2024-08-06T13:18:48.302Z Vendors: n/a Products: n/a Problem Types: n/a Description: Untrusted search path vulnerability in Corel Painter 2015 allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse wacommt.dll file that is located in the same folder as the file being processed. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/534452/100/0/threaded - http://www.coresecurity.com/advisories/corel-software-dll-hijacking - http://seclists.org/fulldisclosure/2015/Jan/33 - http://www.securityfocus.com/bid/72006
CVE ID: CVE-2014-8396 State: PUBLISHED Published: 2015-01-15T15:00:00 Last Updated: 2024-08-06T13:18:48.212Z Vendors: n/a Products: n/a Problem Types: n/a Description: Untrusted search path vulnerability in Corel PDF Fusion allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse quserex.dll file that is located in the same folder as the file being processed. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/72007 - http://www.securityfocus.com/archive/1/534452/100/0/threaded - http://www.coresecurity.com/advisories/corel-software-dll-hijacking - http://seclists.org/fulldisclosure/2015/Jan/33
CVE ID: CVE-2014-8397 State: PUBLISHED Published: 2015-01-15T15:00:00 Last Updated: 2024-08-06T13:18:47.959Z Vendors: n/a Products: n/a Problem Types: n/a Description: Untrusted search path vulnerability in Corel VideoStudio PRO X7 or FastFlick allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse u32ZLib.dll file that is located in the same folder as the file being processed. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/534452/100/0/threaded - http://www.coresecurity.com/advisories/corel-software-dll-hijacking - http://seclists.org/fulldisclosure/2015/Jan/33 - http://www.securityfocus.com/
advisories/corel-software-dll-hijacking - http://seclists.org/fulldisclosure/2015/Jan/33 - http://www.securityfocus.com/bid/72009
CVE ID: CVE-2014-8398 State: PUBLISHED Published: 2015-01-15T15:00:00 Last Updated: 2024-08-06T13:18:47.955Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple untrusted search path vulnerabilities in Corel FastFlick allow local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse (1) igfxcmrt32.dll, (2) ipl.dll, (3) MSPStyleLib.dll, (4) uFioUtil.dll, (5) uhDSPlay.dll, (6) uipl.dll, (7) uvipl.dll, (8) VC1DecDll.dll, or (9) VC1DecDll_SSE3.dll file that is located in the same folder as the file being processed. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/534452/100/0/threaded - http://w
st Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/534452/100/0/threaded - http://www.coresecurity.com/advisories/corel-software-dll-hijacking - http://seclists.org/fulldisclosure/2015/Jan/33 - http://www.securityfocus.com/bid/72010
CVE ID: CVE-2014-8399 State: PUBLISHED Published: 2014-10-31T14:00:00 Last Updated: 2024-08-06T13:18:48.022Z Vendors: n/a Products: n/a Problem Types: n/a Description: The default configuration in systemd-shim 8 enables the Abandon debugging clause, which allows local users to cause a denial of service via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.ubuntu.com/usn/USN-2392-1 - https://github.com/desrt/systemd-shim/commit/d2e91c118f6128875274a638007702d1cc665893
CVE ID: CVE-2014-8412 State: PUBLISHED Published: 2014-11-24T15:00:00 Last Updated: 2024-08-06T13:18:48.295Z Vendors: n/a Products: n/a Problem Types: n/a Description: The (1) VoIP channel drivers, (2) DUNDi, and (3) Asterisk Manager Interface (AMI) in Asterisk Open Source 1.8.x before 1.8.32.1, 11.x before 11.14.1, 12.x before 12.7.1, and 13.x before 13.0.1 and Certified Asterisk 1.8.28 before 1.8.28-cert3 and 11.6 before 11.6-cert8 allows remote attackers to bypass the ACL restrictions via a packet with a source IP that does not share the address family as the first ACL entry. Additional Analyst Notes: - CVE Program Container: References: - http://downloads.asterisk.org/pub/security/AST-20
ntry. Additional Analyst Notes: - CVE Program Container: References: - http://downloads.asterisk.org/pub/security/AST-2014-012.html
CVE ID: CVE-2014-8413 State: PUBLISHED Published: 2014-11-24T15:00:00 Last Updated: 2024-08-06T13:18:48.273Z Vendors: n/a Products: n/a Problem Types: n/a Description: The res_pjsip_acl module in Asterisk Open Source 12.x before 12.7.1 and 13.x before 13.0.1 does not properly create and load ACLs defined in pjsip.conf at startup, which allows remote attackers to bypass intended PJSIP ACL rules. Additional Analyst Notes: - CVE Program Container: References: - http://downloads.asterisk.org/pub/security/AST-2014-013.html
CVE ID: CVE-2014-8414 State: PUBLISHED Published: 2014-11-24T15:00:00 Last Updated: 2024-08-06T13:18:47.850Z Vendors: n/a Products: n/a Problem Types: n/a Description: ConfBridge in Asterisk 11.x before 11.14.1 and Certified Asterisk 11.6 before 11.6-cert8 does not properly handle state changes, which allows remote attackers to cause a denial of service (channel hang and memory consumption) by causing transitions to be delayed, which triggers a state change from hung up to waiting for media. Additional Analyst Notes: - CVE Program Container: References: - http://downloads.asterisk.org/pub/security/AST-2014-014.html - http://seclists.org/fulldisclosure/2014/Nov/67
CVE ID: CVE-2014-8415 State: PUBLISHED Published: 2014-11-24T15:00:00 Last Updated: 2024-08-06T13:18:48.176Z Vendors: n/a Products: n/a Problem Types: n/a Description: Race condition in the chan_pjsip channel driver in Asterisk Open Source 12.x before 12.7.1 and 13.x before 13.0.1 allows remote attackers to cause a denial of service (assertion failure and crash) via a cancel request for a SIP session with a queued action to (1) answer a session or (2) send ringing. Additional Analyst Notes: - CVE Program Container: References: - http://downloads.asterisk.org/pub/security/AST-2014-015.html
CVE ID: CVE-2014-8416 State: PUBLISHED Published: 2014-11-24T15:00:00 Last Updated: 2024-08-06T13:18:47.980Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use-after-free vulnerability in the PJSIP channel driver in Asterisk Open Source 12.x before 12.7.1 and 13.x before 13.0.1, when using the res_pjsip_refer module, allows remote attackers to cause a denial of service (crash) via an in-dialog INVITE with Replaces message, which triggers the channel to be hung up. Additional Analyst Notes: - CVE Program Container: References: - http://downloads.asterisk.org/pub/security/AST-2014-016.html
CVE ID: CVE-2014-8417 State: PUBLISHED Published: 2014-11-24T15:00:00 Last Updated: 2024-08-06T13:18:48.431Z Vendors: n/a Products: n/a Problem Types: n/a Description: ConfBridge in Asterisk 11.x before 11.14.1, 12.x before 12.7.1, and 13.x before 13.0.1 and Certified Asterisk 11.6 before 11.6-cert8 allows remote authenticated users to (1) gain privileges via vectors related to an external protocol to the CONFBRIDGE dialplan function or (2) execute arbitrary system commands via a crafted ConfbridgeStartRecord AMI action. Additional Analyst Notes: - CVE Program Container: References: - http://downloads.asterisk.org/pub/security/AST-2014-017.html
CVE ID: CVE-2014-8418 State: PUBLISHED Published: 2014-11-24T15:00:00 Last Updated: 2024-08-06T13:18:47.847Z Vendors: n/a Products: n/a Problem Types: n/a Description: The DB dialplan function in Asterisk Open Source 1.8.x before 1.8.32, 11.x before 11.1.4.1, 12.x before 12.7.1, and 13.x before 13.0.1 and Certified Asterisk 1.8 before 1.8.28-cert8 and 11.6 before 11.6-cert8 allows remote authenticated users to gain privileges via a call from an external protocol, as demonstrated by the AMI protocol. Additional Analyst Notes: - CVE Program Container: References: - http://downloads.asterisk.org/pub/security/AST-2014-018.html
CVE ID: CVE-2014-8419 State: PUBLISHED Published: 2014-11-26T15:00:00 Last Updated: 2024-08-06T13:18:48.164Z Vendors: n/a Products: n/a Problem Types: n/a Description: Wibu-Systems CodeMeter Runtime before 5.20 uses weak permissions (read and write access for all users) for codemeter.exe, which allows local users to gain privileges via a Trojan horse file. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/129234/CodeMeter-Weak-Service-Permissions.html - http://www.securityfocus.com/archive/1/534079/100/0/threaded