Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2014-100019 State: PUBLISHED Published: 2015-01-13T15:00:00 Last Updated: 2024-08-06T14:10:55.652Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the LTree converter in Pomm before 1.1.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/56986 - https://exchange.xforce.ibmcloud.com/vulnerabilities/91276 - http://www.securityfocus.com/bid/65711 - https://github.com/chanmix51/Pomm/issues/122 - http://www.pomm-project.org/news/pomm-1-1-5-is-out.html
CVE ID: CVE-2014-100020 State: PUBLISHED Published: 2015-01-13T15:00:00 Last Updated: 2024-08-06T14:10:56.253Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in ChangeEmail.php in iTechClassifieds 3.03.057 allows remote attackers to execute arbitrary SQL commands via the PreviewNum parameter. NOTE: the CatID parameter is already covered by CVE-2008-0685. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/90683 - http://www.securityfocus.com/bid/65089 - http://www.exploit-db.com/exploits/31140 - http://osvdb.org/102457
CVE ID: CVE-2014-100021 State: PUBLISHED Published: 2015-01-13T15:00:00Z Last Updated: 2024-09-17T00:45:37.666Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in symfony/web/index.php/pim/viewEmployeeList in OrangeHRM before 3.1.2 allows remote attackers to inject arbitrary web script or HTML via the empsearch[employee_name][empId] parameter. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/57206 - http://www.securityfocus.com/bid/65904 - http://sourceforge.net/projects/orangehrm/files/stable/3.1.2/ - http://hauntit.blogspot.com/2014/02/en-xss-in-orangehrm.html
CVE ID: CVE-2014-100022 State: PUBLISHED Published: 2015-01-13T15:00:00 Last Updated: 2024-08-06T14:10:56.299Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in question.php in the mTouch Quiz before 3.0.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the quiz parameter to wp-admin/edit.php. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/57491 - https://wordpress.org/plugins/mtouch-quiz/changelog/ - https://security.dxw.com/advisories/admin-xss-and-sqli-in-mtouch-quiz-3-0-6/ - https://exchange.xforce.ibmcloud.com/vulnerabilities/91950
CVE ID: CVE-2014-100023 State: PUBLISHED Published: 2015-01-13T15:00:00 Last Updated: 2024-08-06T14:10:55.683Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in question.php in the mTouch Quiz before 3.0.7 for WordPress allow remote attackers to inject arbitrary web script or HTML via the quiz parameter to wp-admin/edit.php. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/57491 - https://exchange.xforce.ibmcloud.com/vulnerabilities/91949 - https://wordpress.org/plugins/mtouch-quiz/changelog/ - https://security.dxw.com/advisories/admin-xss-and-sqli-in-mtouch-quiz-3-0-6/ - https://exc
gins/mtouch-quiz/changelog/ - https://security.dxw.com/advisories/admin-xss-and-sqli-in-mtouch-quiz-3-0-6/ - https://exchange.xforce.ibmcloud.com/vulnerabilities/91950
CVE ID: CVE-2014-100024 State: PUBLISHED Published: 2015-01-13T15:00:00 Last Updated: 2024-08-06T14:10:56.031Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Seo Panel before 3.4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/102462 - http://blog.seopanel.in/2014/01/seo-panel-3-4-0-released/ - http://secunia.com/advisories/56510 - https://exchange.xforce.ibmcloud.com/vulnerabilities/90700
CVE ID: CVE-2014-100025 State: PUBLISHED Published: 2015-01-13T15:00:00 Last Updated: 2024-08-06T14:10:56.190Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in index.php/user_data/insert_user in Savsoft Quiz allows remote attackers to hijack the authentication of administrators for requests that create an administrator account via a crafted request. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/66287 - http://packetstormsecurity.com/files/125379 - http://secunia.com/advisories/57102 - https://exchange.xforce.ibmcloud.com/vulnerabilities/91548
CVE ID: CVE-2014-100026 State: PUBLISHED Published: 2015-01-13T15:00:00 Last Updated: 2024-08-06T14:10:56.583Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in readme.php in the April's Super Functions Pack plugin before 1.4.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/64699 - http://osvdb.org/101807 - http://secunia.com/advisories/55576 - https://exchange.xforce.ibmcloud.com/vulnerabilities/90172 - https://wordpres
07 - http://secunia.com/advisories/55576 - https://exchange.xforce.ibmcloud.com/vulnerabilities/90172 - https://wordpress.org/plugins/aprils-super-functions-pack/changelog/
CVE ID: CVE-2014-100027 State: PUBLISHED Published: 2015-01-13T15:00:00 Last Updated: 2024-08-06T14:10:55.801Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the WP SlimStat plugin before 3.5.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via a crafted URL. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/91840 - https://github.com/getusedtoit/wp-slimstat/issues/3 - http://secunia.com/advisories/57305 - http://www.securityfocus.com/bid/66146
CVE ID: CVE-2014-100028 State: PUBLISHED Published: 2015-01-13T15:00:00 Last Updated: 2024-08-06T14:10:55.672Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in /signup in WEBCrafted allows remote attackers to inject arbitrary web script or HTML via the username. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/124682 - https://exchange.xforce.ibmcloud.com/vulnerabilities/90140 - http://www.securityfocus.com/bid/64681 - http://secunia.com/advisories/56307
CVE ID: CVE-2014-100029 State: PUBLISHED Published: 2015-01-13T15:00:00 Last Updated: 2024-08-06T14:10:56.432Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple directory traversal vulnerabilities in class/session.php in Ganesha Digital Library (GDL) 4.2 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) newlang or (2) newtheme parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/91555 - http://packetstormsecurity.com/files/125464
CVE ID: CVE-2014-100030 State: PUBLISHED Published: 2015-01-13T15:00:00 Last Updated: 2024-08-06T14:10:56.509Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in module/search/function.php in Ganesha Digital Library (GDL) 4.2 allows remote attackers to inject arbitrary web script or HTML via the keyword parameter in a ByEge action. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/91553 - http://secunia.com/advisories/57171 - http://packetstormsecurity.com/files/125464
CVE ID: CVE-2014-100031 State: PUBLISHED Published: 2015-01-13T15:00:00 Last Updated: 2024-08-06T14:10:56.292Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in Ganesha Digital Library (GDL) 4.2 allow remote attackers to execute arbitrary SQL commands via the id parameter in (1) download.php or (2) main.php. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/91554 - http://secunia.com/advisories/57171 - http://packetstormsecurity.com/files/125464
CVE ID: CVE-2014-100032 State: PUBLISHED Published: 2015-01-13T15:00:00 Last Updated: 2024-08-06T14:10:56.370Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in top.html in the Airties Air 6372 modem allows remote attackers to inject arbitrary web script or HTML via the productboardtype parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/128213/Airties-Air6372SO-Modem-Web-Interface-Cross-Site-Scripting.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/95957
CVE ID: CVE-2014-100033 State: PUBLISHED Published: 2015-01-13T15:00:00Z Last Updated: 2024-09-16T18:48:35.296Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in LicensePal ArcticDesk before 1.2.5 allows remote attackers to read arbitrary files via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://blog.rack911.com/security-advisories/arcticdesk-custom-module-local-file-inclusion-vulnerability-r911-0132/ - http://www.arcticdesk.com/support/announcements/arcticdesk-v1-2-5-maintenance-release-18.html - http://secunia.com/advisories/57299
CVE ID: CVE-2014-100034 State: PUBLISHED Published: 2015-01-13T15:00:00 Last Updated: 2024-08-06T14:10:56.561Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the frontend interface in LicensePal ArcticDesk before 1.2.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/91792 - http://www.arcticdesk.com/support/announcements/arcticdesk-v1-2-5-maintenance-release-18.html - http://secunia.com/advisories/57299
CVE ID: CVE-2014-100035 State: PUBLISHED Published: 2015-01-13T15:00:00Z Last Updated: 2024-09-17T00:35:54.198Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the ticket grid in the admin interface in LicensePal ArcticDesk before 1.2.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.arcticdesk.com/support/announcements/arcticdesk-v1-2-5-maintenance-release-18.html
CVE ID: CVE-2014-100036 State: PUBLISHED Published: 2015-01-13T15:00:00 Last Updated: 2024-08-06T14:10:56.375Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in FlatPress 1.0.2 allows remote attackers to inject arbitrary web script or HTML via the content parameter to the default URI. Additional Analyst Notes: - CVE Program Container: References: - https://www.netsparker.com/critical-xss-vulnerabilities-in-flatpress/ - http://secunia.com/advisories/57808 - https://github.com/evacchi/flatpress/issues/14 - https://exchange.xforce.ibmcloud.com/vulnerabilities/92538
CVE ID: CVE-2014-100037 State: PUBLISHED Published: 2015-01-13T15:00:00Z Last Updated: 2024-09-16T19:01:15.254Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Storytlr 1.3.dev and earlier allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to archives/. Additional Analyst Notes: - CVE Program Container: References: - https://www.netsparker.com/xss-vulnerability-in-storytlr/ - http://secunia.com/advisories/57182
CVE ID: CVE-2014-100038 State: PUBLISHED Published: 2015-01-13T15:00:00 Last Updated: 2024-08-06T14:10:56.260Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Storytlr 1.3.dev and earlier allows remote attackers to inject arbitrary web script or HTML via the search parameter to search/. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/57182 - https://exchange.xforce.ibmcloud.com/vulnerabilities/91762 - https://www.netsparker.com/critical-xss-vulnerabilities-in-storytlr/
CVE ID: CVE-2014-100039 State: PUBLISHED Published: 2015-01-13T15:00:00Z Last Updated: 2024-09-16T23:05:41.384Z Vendors: n/a Products: n/a Problem Types: n/a Description: mbae.sys in Malwarebytes Anti-Exploit before 1.05.1.2014 allows local users to cause a denial of service (crash) via a crafted size in an unspecified IOCTL call, which triggers an out-of-bounds read. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.osvdb.org/114249 - https://www.malwarebytes.org/support/releasehistory/
CVE ID: CVE-2014-10000 State: REJECTED Published: 2015-01-13T11:00:00 Last Updated: 2015-01-13T15:57:00 Description: No description available.
CVE ID: CVE-2014-10001 State: PUBLISHED Published: 2015-01-13T11:00:00 Last Updated: 2024-08-06T14:02:37.872Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in PHPJabbers Appointment Scheduler 2.0 allow remote attackers to hijack the authentication of administrators for requests that (1) conduct cross-site scripting (XSS) attacks via the i18n[1][name] parameter in a pjActionCreate action to the pjAdminServices controller or (2) add an administrator via a pjActionCreate action to the pjAdminUsers controller. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/30911 - https://
er. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/30911 - https://exchange.xforce.ibmcloud.com/vulnerabilities/90419 - http://secunia.com/advisories/56377 - http://packetstormsecurity.com/files/124755 - https://exchange.xforce.ibmcloud.com/vulnerabilities/90420
CVE ID: CVE-2014-10002 State: PUBLISHED Published: 2015-01-13T11:00:00Z Last Updated: 2024-09-16T22:41:01.598Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in JetBrains TeamCity before 8.1 allows remote attackers to obtain sensitive information via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - http://confluence.jetbrains.com/display/TCD8/What%27s+New+in+TeamCity+8.1 - http://secunia.com/advisories/57221
CVE ID: CVE-2014-10003 State: PUBLISHED Published: 2015-01-13T11:00:00 Last Updated: 2024-08-06T14:02:37.930Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Maian Uploader 4.0 allow remote attackers to inject arbitrary web script or HTML via the width parameter to (1) uploader/admin/js/load_flv.js.php or (2) uploader/js/load_flv.js.php. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/102489 - https://exchange.xforce.ibmcloud.com/vulnerabilities/90716 - http://packetstormsecurity.com/files/124918
CVE ID: CVE-2014-10004 State: PUBLISHED Published: 2015-01-13T11:00:00 Last Updated: 2024-08-06T14:02:38.131Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in admin/data_files/move.php in Maian Uploader 4.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/102488 - https://exchange.xforce.ibmcloud.com/vulnerabilities/90715 - http://packetstormsecurity.com/files/124918
CVE ID: CVE-2014-10005 State: PUBLISHED Published: 2015-01-13T11:00:00Z Last Updated: 2024-09-17T01:01:08.799Z Vendors: n/a Products: n/a Problem Types: n/a Description: Maian Uploader 4.0 allows remote attackers to obtain sensitive information via a request without the height parameter to load_flv.js.php, which reveals the installation path in an error message. Additional Analyst Notes: - CVE Program Container: References: - http://www.osvdb.org/102487 - http://packetstormsecurity.com/files/124918
CVE ID: CVE-2014-10006 State: PUBLISHED Published: 2015-01-13T11:00:00Z Last Updated: 2024-09-16T22:02:33.756Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Maian Uploader 4.0 allow remote attackers to hijack the authentication of unspecified users for requests that conduct cross-site scripting (XSS) attacks via the width parameter to (1) uploader/admin/js/load_flv.js.php or (2) uploader/js/load_flv.js.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/124918
CVE ID: CVE-2014-10007 State: PUBLISHED Published: 2015-01-13T11:00:00 Last Updated: 2024-08-06T14:02:38.048Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Maian Weblog 4.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) email, or (3) subject parameter in a contact action to index.php. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/90961 - http://secunia.com/advisories/56797 - https://www.netsparker.com/critical-xss-vulnerabilities-in-maian-weblog/
CVE ID: CVE-2014-10008 State: PUBLISHED Published: 2015-01-13T11:00:00 Last Updated: 2024-08-06T14:02:38.380Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Stark CRM 1.0 allow remote attackers to hijack the authentication of administrators for requests that add (1) an administrator via a crafted request to the admin page, (2) an agent via a crafted request to the agent page, (3) a sub-agent via a crafted request to the sub_agent page, (4) a partner via a crafted request to the partner page, or (5) a client via a crafted request to the client page. Additional Analyst Notes: - CVE Program Container: References: - http:/
client via a crafted request to the client page. Additional Analyst Notes: - CVE Program Container: References: - http://www.zeroscience.mk/codes/starkcrm_mv.txt - https://exchange.xforce.ibmcloud.com/vulnerabilities/91268 - http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5169.php - http://secunia.com/advisories/57048 - https://exchange.xforce.ibmcloud.com/vulnerabilities/91267
CVE ID: CVE-2014-10009 State: PUBLISHED Published: 2015-01-13T11:00:00 Last Updated: 2024-08-06T14:02:38.188Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Stark CRM 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) first_name, (2) last_name, or (3) notes parameter to the client page; (4) insu_name or (5) price parameter to the add_insurance_cat page; or (6) status[] parameter to the add_status page. Additional Analyst Notes: - CVE Program Container: References: - http://www.zeroscience.mk/codes/starkcrm_mv.txt - http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5169.php - http://secunia.com/a
science.mk/codes/starkcrm_mv.txt - http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5169.php - http://secunia.com/advisories/57048 - https://exchange.xforce.ibmcloud.com/vulnerabilities/91267
CVE ID: CVE-2014-10010 State: PUBLISHED Published: 2015-01-13T11:00:00 Last Updated: 2024-08-06T14:02:38.070Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in PHPJabbers Appointment Scheduler 2.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the id parameter in a pjActionDownload action to the pjBackup controller. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/30911 - https://exchange.xforce.ibmcloud.com/vulnerabilities/90421 - http://packetstormsecurity.com/files/124755
CVE ID: CVE-2014-10011 State: PUBLISHED Published: 2015-01-13T11:00:00 Last Updated: 2024-08-06T14:02:38.170Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in UltraCamLib in the UltraCam ActiveX Control (UltraCamX.ocx) for the TRENDnet SecurView camera TV-IP422WN allows remote attackers to execute arbitrary code via a long string to the (1) CGI_ParamSet, (2) OpenFileDlg, (3) SnapFileName, (4) Password, (5) SetCGIAPNAME, (6) AccountCode, or (7) RemoteHost function. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/98948 - http://www.securityfocus.com/bid/71292 - http://www.zeroscience.
://exchange.xforce.ibmcloud.com/vulnerabilities/98948 - http://www.securityfocus.com/bid/71292 - http://www.zeroscience.mk/codes/trendnet_bof.txt - http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5211.php - http://packetstormsecurity.com/files/129262/TRENDnet-SecurView-Wireless-Network-Camera-TV-IP422WN-Buffer-Overflow.html
CVE ID: CVE-2014-10012 State: PUBLISHED Published: 2015-01-13T11:00:00 Last Updated: 2024-08-06T14:02:37.897Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Another WordPress Classifieds Plugin plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the query string to the default URI. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/129035/Another-WordPress-Classifieds-Cross-Site-Scripting-SQL-Injection.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/98588
CVE ID: CVE-2014-10013 State: PUBLISHED Published: 2015-01-13T11:00:00 Last Updated: 2024-08-06T14:02:38.185Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the Another WordPress Classifieds Plugin plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the keywordphrase parameter in a dosearch action. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/129035/Another-WordPress-Classifieds-Cross-Site-Scripting-SQL-Injection.html - http://www.exploit-db.com/exploits/35204 - https://exchange.xforce.ibmcloud.com/vulnerabilities/98589
CVE ID: CVE-2014-10014 State: PUBLISHED Published: 2015-01-13T11:00:00 Last Updated: 2024-08-06T14:02:38.088Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in PHPJabbers Event Booking Calendar 2.0 allow remote attackers to hijack the authentication of administrators for requests that (1) change the username and password of the administrator via an update action to the AdminOptions controller or conduct cross-site scripting (XSS) attacks via the (2) event_title parameter in a create action to the AdminEvents controller or (3) category_title parameter in a create action to the AdminCategories controller. Additional Analyst
ents controller or (3) category_title parameter in a create action to the AdminCategories controller. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/90413 - https://exchange.xforce.ibmcloud.com/vulnerabilities/90414 - http://secunia.com/advisories/56373 - http://packetstormsecurity.com/files/124753/eventbookingcalendar-xssxsrfsql.txt
CVE ID: CVE-2014-10015 State: PUBLISHED Published: 2015-01-13T11:00:00Z Last Updated: 2024-09-17T00:41:01.415Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in load-calendar.php in PHPJabbers Event Booking Calendar 2.0 allows remote attackers to execute arbitrary SQL commands via the cid parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/124753/eventbookingcalendar-xssxsrfsql.txt