Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2014-9326 State: PUBLISHED Published: 2015-05-12T19:00:00 Last Updated: 2024-08-06T13:40:24.979Z Vendors: n/a Products: n/a Problem Types: n/a Description: The automatic signature update functionality in the (1) Phone Home feature in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, GTM, and Link Controller 11.5.0 through 11.6.0, ASM 10.0.0 through 11.6.0, and PEM 11.3.0 through 11.6.0 and the (2) Call Home feature in ASM 10.0.0 through 11.6.0 and PEM 11.3.0 through 11.6.0 does not properly validate server SSL certificates, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate. Additional Analyst Notes: - CVE Program Container: References: - http://w
-the-middle attacks via a crafted certificate. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1032305 - https://support.f5.com/kb/en-us/solutions/public/16000/000/sol16090.html
CVE ID: CVE-2014-9328 State: PUBLISHED Published: 2015-02-03T16:00:00 Last Updated: 2024-08-06T13:40:25.115Z Vendors: n/a Products: n/a Problem Types: n/a Description: ClamAV before 0.98.6 allows remote attackers to have unspecified impact via a crafted upack packer file, related to a "heap out of bounds condition." Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201512-08 - http://www.securityfocus.com/bid/72372 - http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00014.html - http://securitytracker.com/id/1031672 - http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148950.html - http://blog.clamav.net/2015/0
672 - http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148950.html - http://blog.clamav.net/2015/01/clamav-0986-has-been-released.html - http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00020.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148958.html - http://www.ubuntu.com/usn/USN-2488-2 - http://lists.opensuse.org/opensuse-updates/2015-05/msg00024.html - http://secunia.com/advisories/62536 - http://secunia.com/advisories/62757
CVE ID: CVE-2014-9330 State: PUBLISHED Published: 2015-01-20T15:00:00 Last Updated: 2024-08-06T13:40:24.952Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow in tif_packbits.c in bmp2tif in libtiff 4.0.3 allows remote attackers to cause a denial of service (crash) via crafted BMP image, related to dimensions, which triggers an out-of-bounds read. Additional Analyst Notes: - CVE Program Container: References: - http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html - http://www.securityfocus.com/bid/71789 - http://rhn.redhat.com/errata/RHSA-2016-1547.html - http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
hat.com/errata/RHSA-2016-1547.html - http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html - https://security.gentoo.org/glsa/201701-16 - http://www.securitytracker.com/id/1031442 - http://www.debian.org/security/2015/dsa-3273 - http://seclists.org/fulldisclosure/2014/Dec/97 - http://rhn.redhat.com/errata/RHSA-2016-1546.html - http://bugzilla.maptools.org/show_bug.cgi?id=2494
CVE ID: CVE-2014-9331 State: PUBLISHED Published: 2015-02-04T16:00:00 Last Updated: 2024-08-06T13:40:25.020Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in ZOHO ManageEngine Desktop Central before 9 build 90130 allows remote attackers to hijack the authentication of administrators for requests that add an administrator account via an addUser action to STATE_ID/1417736606982/roleMgmt.do. Additional Analyst Notes: - CVE Program Container: References: - http://www.manageengine.com/products/desktop-central/cve20149331-cross-site-request-forgery.html - http://www.securityfocus.com/bid/72464 - http://www.exploit-db.com/exploits/35980 -
31-cross-site-request-forgery.html - http://www.securityfocus.com/bid/72464 - http://www.exploit-db.com/exploits/35980 - http://www.securityfocus.com/archive/1/534604/100/0/threaded - http://packetstormsecurity.com/files/130219/ManageEngine-Desktop-Central-9-Cross-Site-Request-Forgery.html
CVE ID: CVE-2014-9334 State: PUBLISHED Published: 2014-12-24T18:00:00 Last Updated: 2024-08-06T13:40:25.010Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Bird Feeder plugin 1.2.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) user or (2) password parameter in the bird-feeder page to wp-admin/options-general.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/129623/WordPress-Bird-Feeder-1.2.3-CSRF-XSS.html - http://seclists.org/fulldisclosure/2014/Dec
etstormsecurity.com/files/129623/WordPress-Bird-Feeder-1.2.3-CSRF-XSS.html - http://seclists.org/fulldisclosure/2014/Dec/69 - https://exchange.xforce.ibmcloud.com/vulnerabilities/99474 - http://www.vulnerability-lab.com/get_content.php?id=1372
CVE ID: CVE-2014-9335 State: PUBLISHED Published: 2014-12-19T15:00:00 Last Updated: 2024-08-06T13:40:25.193Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the DandyID Services plugin 1.5.9 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) email_address or (2) sidebarTitle parameter in the dandyid-services.php page to wp-admin/options-general.php. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/99502 - http://packetstormsecurity.com/
am Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/99502 - http://packetstormsecurity.com/files/129575/WordPress-DandyID-Services-ID-1.5.9-CSRF-XSS.html
CVE ID: CVE-2014-9336 State: PUBLISHED Published: 2014-12-19T15:00:00 Last Updated: 2024-08-06T13:40:25.101Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the iTwitter plugin 0.04 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) itex_t_twitter_username or (2) itex_t_twitter_userpass parameter in the iTwitter.php page to wp-admin/options-general.php. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2014/Dec/72 - http://packetstormsecurity.com/files/12
rogram Container: References: - http://seclists.org/fulldisclosure/2014/Dec/72 - http://packetstormsecurity.com/files/129576/WordPress-iTwitter-WP-0.04-CSRF-XSS.html
CVE ID: CVE-2014-9337 State: PUBLISHED Published: 2014-12-19T15:00:00 Last Updated: 2024-08-06T13:40:25.263Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Mikiurl Wordpress Eklentisi plugin 2.0 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) twitter_kullanici or (2) twitter_sifre parameter in a kaydet action in the mikiurl.php page to wp-admin/options-general.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/129577/Mikiurl-WordPress-Eklent
alyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/129577/Mikiurl-WordPress-Eklentisi-2.0-CSRF-XSS.html
CVE ID: CVE-2014-9338 State: PUBLISHED Published: 2014-12-19T15:00:00 Last Updated: 2024-08-06T13:40:24.997Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the O2Tweet plugin 0.0.4 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) o2t_username or (2) o2t_tags parameter to wp-admin/options-general.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/129578/WordPress-O2Tweet-0.0.4-CSRF-XSS.html
CVE ID: CVE-2014-9339 State: PUBLISHED Published: 2014-12-19T15:00:00 Last Updated: 2024-08-06T13:40:25.040Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the SPNbabble plugin 1.4.1 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) username or (2) password parameter in the spnbabble.php page to wp-admin/options-general.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/129580/WordPress-SPNbabble-1.4.1-CSRF-XSS.html
CVE ID: CVE-2014-9340 State: PUBLISHED Published: 2014-12-19T15:00:00 Last Updated: 2024-08-06T13:40:25.029Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the wpCommentTwit plugin 0.5 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) username or (2) password parameter in the wpCommentTwit.php page to wp-admin/options-general.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/129581/WordPress-wpCommentTwit-0.5-CSRF-XSS.html
CVE ID: CVE-2014-9341 State: PUBLISHED Published: 2014-12-19T15:00:00 Last Updated: 2024-08-06T13:40:24.949Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the yURL ReTwitt plugin 1.4 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) yurl_login or (2) yurl_anchor parameter in the yurl page to wp-admin/options-general.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/129582/WordPress-yURL-ReTwitt-WP-1.4-CSRF-XSS.html
CVE ID: CVE-2014-9342 State: PUBLISHED Published: 2014-12-08T11:00:00 Last Updated: 2024-08-06T13:40:24.987Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the tree view (pl_tree.php) feature in Application Security Manager (ASM) in F5 BIG-IP 11.3.0 allows remote attackers to inject arbitrary web script or HTML by accessing a crafted URL during automatic policy generation. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/534137/100/0/threaded - https://support.f5.com/kb/en-us/solutions/public/15000/900/sol15939.html - http://secunia.com/advisories/62000 - https://support.f5.com/csp/
om/kb/en-us/solutions/public/15000/900/sol15939.html - http://secunia.com/advisories/62000 - https://support.f5.com/csp/article/K15939
CVE ID: CVE-2014-9343 State: PUBLISHED Published: 2014-12-08T16:00:00 Last Updated: 2024-08-06T13:40:24.994Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open redirect vulnerability in modules/system/controller/selectlanguage.class.php in Snowfox CMS 1.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the rd parameter in a submit action to snowfox/. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/99128 - http://osvdb.org/show/osvdb/114850 - https://github.com/GlobizSolutions/snowfox/releases - http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5206
14850 - https://github.com/GlobizSolutions/snowfox/releases - http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5206.php - https://github.com/GlobizSolutions/snowfox/commit/55a8e44a9d9a9a788cc1cde6baf0c2c67e0c736a - http://packetstormsecurity.com/files/129162/Snowfox-CMS-1.0-Open-Redirect.html
CVE ID: CVE-2014-9344 State: PUBLISHED Published: 2014-12-08T16:00:00 Last Updated: 2024-08-06T13:40:24.951Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in Snowfox CMS before 1.0.10 allows remote attackers to hijack the authentication of administrators for requests that add a new admin account via a submit action in the admin/accounts/create uri to snowfox/. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/99128 - https://github.com/GlobizSolutions/snowfox/releases - http://osvdb.org/show/osvdb/114819 - http://packetstormsecurity.com/files/129164/Snowfox-CMS-1.0
ions/snowfox/releases - http://osvdb.org/show/osvdb/114819 - http://packetstormsecurity.com/files/129164/Snowfox-CMS-1.0-Cross-Site-Request-Forgery.html - http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5205.php
CVE ID: CVE-2014-9345 State: PUBLISHED Published: 2014-12-08T16:00:00Z Last Updated: 2024-09-17T01:26:11.764Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Guruperl.net Advertise With Pleasure! Professional (aka AWP PRO) 6.6 and earlier allows remote attackers to execute arbitrary SQL commands via the group_id parameter in a list_zone action to cgi/client.cgi. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/129390/Advertise-With-Pleasure-AWP-6.6-SQL-Injection.html - http://www.exploit-db.com/exploits/35463 - http://osvdb.org/show/osvdb/115317
CVE ID: CVE-2014-9346 State: PUBLISHED Published: 2014-12-08T16:00:00 Last Updated: 2024-08-06T13:40:25.107Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the Hierarchical Select module 6.x-3.x before 6.x-3.9 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors related to the (1) taxonomy term title for instances with Save term lineage enabled or (2) entity type fields. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/99136 - https://www.drupal.org/node/2385933 - https://www.drupal.org/node/
/exchange.xforce.ibmcloud.com/vulnerabilities/99136 - https://www.drupal.org/node/2385933 - https://www.drupal.org/node/2386615 - http://secunia.com/advisories/60511
CVE ID: CVE-2014-9347 State: PUBLISHED Published: 2014-12-08T16:00:00 Last Updated: 2024-08-06T13:40:24.943Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in dosearch.php in phpMyRecipes 1.2.2 allows remote attackers to execute arbitrary SQL commands via the words_exact parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/35365 - http://osvdb.org/show/osvdb/115038 - https://exchange.xforce.ibmcloud.com/vulnerabilities/99005
CVE ID: CVE-2014-9348 State: PUBLISHED Published: 2014-12-08T16:00:00 Last Updated: 2024-08-06T13:40:25.031Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the formulaireRobot function in admin/robots.lib.php in RobotStats 1.0 allows remote attackers to execute arbitrary SQL commands via the robot parameter to admin/robots.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/129229/RobotStats-1.0-SQL-Injection.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/98951 - http://www.exploit-db.com/exploits/35344
CVE ID: CVE-2014-9349 State: PUBLISHED Published: 2014-12-08T16:00:00 Last Updated: 2024-08-06T13:40:25.163Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in admin/robots.lib.php in RobotStats 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) nom or (2) user_agent parameter to admin/robots.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/129230/RobotStats-1.0-Cross-Site-Scripting.html - http://www.exploit-db.com/exploits/35342 - https://exchange.xforce.ibmcloud.com/vulnerabilities/98950
CVE ID: CVE-2014-9350 State: PUBLISHED Published: 2014-12-08T16:00:00 Last Updated: 2024-08-06T13:40:25.028Z Vendors: n/a Products: n/a Problem Types: n/a Description: TP-Link TL-WR740N 4 with firmware 3.17.0 Build 140520, 3.16.6 Build 130529, and 3.16.4 Build 130205 allows remote attackers to cause a denial of service (httpd crash) via vectors involving a "new" value in the isNew parameter to PingIframeRpm.htm. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/98927 - http://packetstormsecurity.com/files/129227/TP-Link-TL-WR740N-Denial-Of-Service.html - http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5210.php - http:/
29227/TP-Link-TL-WR740N-Denial-Of-Service.html - http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5210.php - http://www.exploit-db.com/exploits/35345 - http://www.osvdb.org/115017
CVE ID: CVE-2014-9351 State: PUBLISHED Published: 2014-12-09T22:52:00Z Last Updated: 2024-09-17T00:41:56.725Z Vendors: n/a Products: n/a Problem Types: n/a Description: engine/server/server.cpp in Teeworlds 0.6.x before 0.6.3 allows remote attackers to read memory and cause a denial of service (crash) via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=770514 - http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145173.html - https://www.teeworlds.com/?page=news&id=11200 - http://www.securityfocus.com/bid/71301 - http://lists.fedoraproject.org/pipermail/package-announce/2014-December/1
200 - http://www.securityfocus.com/bid/71301 - http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145650.html - http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145172.html - https://github.com/teeworlds/teeworlds/commit/a766cb44bcffcdb0b88e776d01c5ee1323d44f85
CVE ID: CVE-2014-9352 State: PUBLISHED Published: 2014-12-09T22:52:00 Last Updated: 2024-08-06T13:40:24.996Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the mail administration login panel in Scalix Web Access 11.4.6.12377 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/533861/100/0/threaded - http://seclists.org/fulldisclosure/2014/Oct/133 - https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20141031-0_Scalix_Web_Access_XXE_v10.txt
CVE ID: CVE-2014-9353 State: PUBLISHED Published: 2015-02-06T11:00:00 Last Updated: 2024-08-06T13:40:24.991Z Vendors: n/a Products: n/a Problem Types: n/a Description: NetApp OnCommand Balance before 4.2P2 contains a "default privileged account," which allows remote attackers to gain privileges via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://kb.netapp.com/support/index?page=content&id=9010020
CVE ID: CVE-2014-9354 State: PUBLISHED Published: 2015-02-06T11:00:00 Last Updated: 2024-08-06T13:40:25.039Z Vendors: n/a Products: n/a Problem Types: n/a Description: NetApp OnCommand Balance before 4.2P3 allows local users to obtain sensitive information via unspecified vectors related to cleartext storage. Additional Analyst Notes: - CVE Program Container: References: - https://kb.netapp.com/support/index?page=content&id=9010021
CVE ID: CVE-2014-9355 State: PUBLISHED Published: 2014-12-19T15:00:00 Last Updated: 2024-08-06T13:40:25.044Z Vendors: n/a Products: n/a Problem Types: n/a Description: Puppet Enterprise before 3.7.1 allows remote authenticated users to obtain licensing and certificate signing request information by leveraging access to an unspecified API endpoint. Additional Analyst Notes: - CVE Program Container: References: - http://puppetlabs.com/security/cve/cve-2014-9355 - http://secunia.com/advisories/61265
CVE ID: CVE-2014-9356 State: PUBLISHED Published: 2019-12-02T17:07:40 Last Updated: 2024-08-06T13:40:25.025Z Vendors: n/a Products: n/a Problem Types: n/a Description: Path traversal vulnerability in Docker before 1.3.3 allows remote attackers to write to arbitrary files and bypass a container protection mechanism via a full pathname in a symlink in an (1) image or (2) build in a Dockerfile. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/archive/1/534215/100/0/threaded
CVE ID: CVE-2014-9357 State: PUBLISHED Published: 2014-12-16T18:00:00 Last Updated: 2024-08-06T13:40:25.038Z Vendors: n/a Products: n/a Problem Types: n/a Description: Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build in a Dockerfile in an LZMA (.xz) archive, related to the chroot for archive extraction. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/forum/#%21msg/docker-user/nFAz-B-n4Bw/0wr3wvLsnUwJ - http://www.securityfocus.com/archive/1/534215/100/0/threaded
CVE ID: CVE-2014-9358 State: PUBLISHED Published: 2014-12-16T18:00:00 Last Updated: 2024-08-06T13:40:25.168Z Vendors: n/a Products: n/a Problem Types: n/a Description: Docker before 1.3.3 does not properly validate image IDs, which allows remote attackers to conduct path traversal attacks and spoof repositories via a crafted image in a (1) "docker load" operation or (2) "registry communications." Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/forum/#%21msg/docker-user/nFAz-B-n4Bw/0wr3wvLsnUwJ - http://www.securityfocus.com/archive/1/534215/100/0/threaded
CVE ID: CVE-2014-9360 State: PUBLISHED Published: 2014-12-10T15:00:00 Last Updated: 2024-08-06T13:40:25.040Z Vendors: n/a Products: n/a Problem Types: n/a Description: XML external entity (XXE) vulnerability in Scalix Web Access 11.4.6.12377 and 12.2.0.14697 allows remote attackers to read arbitrary files and trigger requests to intranet servers via a crafted request. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/533861/100/0/threaded - http://seclists.org/fulldisclosure/2014/Oct/133 - https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20141031-0_Scalix_Web_Access_XXE_v10.txt
CVE ID: CVE-2014-9361 State: PUBLISHED Published: 2014-12-10T20:00:00Z Last Updated: 2024-09-17T01:36:53.842Z Vendors: n/a Products: n/a Problem Types: n/a Description: The LoginToboggan module 7.x-1.x before 7.x-1.4 for Drupal does not properly unset the authorized user role for certain users, which allows remote attackers with the pre-authorized role to gain privileges and possibly obtain sensitive information by accessing a Page Not Found (404) page. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/node/2300369 - https://www.drupal.org/node/2299467
CVE ID: CVE-2014-9362 State: PUBLISHED Published: 2014-12-10T20:00:00Z Last Updated: 2024-09-16T20:06:44.286Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the path-based meta tag editing form in the Meta tags quick module 7.x-2.x before 7.x-2.8 for Drupal allows remote authenticated users with the "Edit path based meta tags" permission to inject arbitrary web script or HTML via vectors related to deleting a Path-based Metatag. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/node/2296511 - https://www.drupal.org/node/2295975