Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2014-8570 State: PUBLISHED Published: 2017-04-02T20:00:00 Last Updated: 2024-08-06T13:18:48.496Z Vendors: n/a Products: S9300, S9303, S9306, S9312, S7700, S7703, S7706, S7712, S9300E, S9303E, S9306E, S9312E, S9700, S9703, S9706, S9712,S12708, S12712,5700HI,5300HI, 5710EI,5310EI, 5710HI,5310HI, 6700EI,6300EI S9300, S9303, S9306, S9312 with software V100R002,S7700, S7703, S7706, S7712 with software V100R003, V100R006, V200R001, V200R002, V200R003, V200R005,S9300E, S9303E, S9306E, S9312E with software V200R001,S9700, S9703, S9706, S9712 with software V200R002, V200R003, V200R005,S12708, S12712 with software V200R005,5700HI,5300HI with software V100R006, V200R001, V200R002, V200R003,
R003, V200R005,S12708, S12712 with software V200R005,5700HI,5300HI with software V100R006, V200R001, V200R002, V200R003, V200R005,5710EI,5310EI with software V200R002, V200R003, V200R005,5710HI,5310HI with software V200R003, V200R005,6700EI,6300EI with software V200R00 Problem Types: Information Leakage Description: Huawei S9300, S9303, S9306, S9312 with software V100R002; S7700, S7703, S7706, S7712 with software V100R003, V100R006, V200R001, V200R002, V200R003, V200R005; S9300E, S9303E, S9306E, S9312E with software V200R001; S9700, S9703, S9706, S9712 with software V200R002, V200R003, V200R005; S12708, S12712 with software V200R005; 5700HI, 5300HI with software V100R006, V200R001, V200R002,
2, V200R003, V200R005; S12708, S12712 with software V200R005; 5700HI, 5300HI with software V100R006, V200R001, V200R002, V200R003, V200R005; 5710EI, 5310EI with software V200R002, V200R003, V200R005; 5710HI, 5310HI with software V200R003, V200R005; 6700EI, 6300EI with software V200R005 could cause a leak of IP addresses of devices, related to unintended interface support for VRP MPLS LSP Ping. Additional Analyst Notes: - CVE Program Container: References: - http://www.huawei.com/en/psirt/security-advisories/hw-372145
CVE ID: CVE-2014-8571 State: PUBLISHED Published: 2017-04-02T20:00:00 Last Updated: 2024-08-06T13:18:48.493Z Vendors: n/a Products: EDGE-U00,EDGE-T00,EDGE-C00 EDGE-U00 V100R001C17B508SP01 and earlier versions,V100R001C17B508SP02,EDGE-T00 V100R001C01B508SP01 and earlier versions,V100R001C01B508SP02,EDGE-C00 V100R001C92B508SP02 and earlier versions,V100R001C92B508SP03 Problem Types: Screen Capture Description: Apps on Huawei Ascend P6 mobile phones with software EDGE-U00 V100R001C17B508SP01 and earlier versions before V100R001C17B508SP02; EDGE-T00 V100R001C01B508SP01 and earlier versions before V100R001C01B508SP02; EDGE-C00 V100R001C92B508SP02 and earlier versions before V100R001C92B508SP03 ca
ier versions before V100R001C01B508SP02; EDGE-C00 V100R001C92B508SP02 and earlier versions before V100R001C92B508SP03 can capture screens without the root permission. As a result, user information can be leaked by malware on Ascend P6 mobile phones. Additional Analyst Notes: - CVE Program Container: References: - http://www.huawei.com/en/psirt/security-advisories/hw-372118
CVE ID: CVE-2014-8572 State: PUBLISHED Published: 2017-04-02T20:00:00 Last Updated: 2024-08-06T13:18:48.644Z Vendors: n/a Products: AC6605,AC6605,ACU,S2300, S3300,S2700, S3700,S5300, S5700,S6300, S6700,S7700, S9300,S9300E, S9700, AC6605 AC6605 V200R001C00, AC6605 V200R002C00,ACU ACU V200R001C00, ACU V200R002C00,S2300, S3300, V100R006C05 and earlier versions,S2700, S3700,S5300, S5700, V100R006,?S6300, S6700 V200R001, V200R002, V200R003, V200R005C00SPC300 and earlier versions,S7700, S9300, V100R006,S9300E, S9700 V200R001, V200R002, V200R003, V200R005C00SPC300 and earlier versions, Problem Types: SSH Denial of Service Description: Huawei AC6605 with software V200R001C00; AC6605 with software V2
ions, Problem Types: SSH Denial of Service Description: Huawei AC6605 with software V200R001C00; AC6605 with software V200R002C00; ACU with software V200R001C00; ACU with software V200R002C00; S2300, S3300, S2700, S3700 with software V100R006C05 and earlier versions; S5300, S5700, S6300, S6700 with software V100R006, V200R001, V200R002, V200R003, V200R005C00SPC300 and earlier versions; S7700, S9300, S9300E, S9700 with software V100R006, V200R001, V200R002, V200R003, V200R005C00SPC300 and earlier versions could allow remote attackers to send a special SSH packet to the VRP device to cause a denial of service. Additional Analyst Notes: - CVE Program Container: References: - http://www.huawei.c
evice to cause a denial of service. Additional Analyst Notes: - CVE Program Container: References: - http://www.huawei.com/en/psirt/security-advisories/hw-373182
CVE ID: CVE-2014-8573 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2014-8574 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2014-8575 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2014-8576 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2014-8577 State: PUBLISHED Published: 2014-10-31T14:00:00 Last Updated: 2024-08-06T13:18:48.494Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Croogo before 2.1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) data[Contact][title] parameter to admin/contacts/contacts/add page; (2) data[Block][title] or (3) data[Block][alias] parameter to admin/blocks/blocks/edit page; (4) data[Region][title] parameter to admin/blocks/regions/add page; (5) data[Menu][title] or (6) data[Menu][alias] parameter to admin/menus/menus/add page; or (7) data[Link][title] parameter to admin/menus/links/add/menu p
Menu][alias] parameter to admin/menus/menus/add page; or (7) data[Link][title] parameter to admin/menus/links/add/menu page. Additional Analyst Notes: - CVE Program Container: References: - http://www.osvdb.org/113110 - https://exchange.xforce.ibmcloud.com/vulnerabilities/96991 - http://www.exploit-db.com/exploits/34959 - http://www.osvdb.org/113113 - http://zeroscience.mk/en/vulnerabilities/ZSL-2014-5201.php - http://packetstormsecurity.com/files/128639/Croogo-2.0.0-Cross-Site-Scripting.html - http://blog.croogo.org/blog/croogo-210-released - http://www.osvdb.org/113109 - http://www.osvdb.org/113111
CVE ID: CVE-2014-8578 State: PUBLISHED Published: 2014-10-31T15:00:00Z Last Updated: 2024-09-17T01:30:57.110Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Groups panel in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administrators to inject arbitrary web script or HTML via a user email address, a different vulnerability than CVE-2014-3475. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/68456 - https://bugs.launchpad.net/horizon/+bug/1320235 - http://www.openwall.com/lists/oss-security/2014/07/08/6
CVE ID: CVE-2014-8579 State: PUBLISHED Published: 2018-01-05T16:00:00 Last Updated: 2024-08-06T13:18:48.517Z Vendors: n/a Products: n/a Problem Types: n/a Description: TRENDnet TEW-823DRU devices with firmware before 1.00b36 have a hardcoded password of kcodeskcodes for the root account, which makes it easier for remote attackers to obtain access via an FTP session. Additional Analyst Notes: - CVE Program Container: References: - http://hackingcomtapioca.blogspot.com.br/2014/10/hacking-trendnet-tew-823dru.html
CVE ID: CVE-2014-8580 State: PUBLISHED Published: 2014-11-07T19:00:00 Last Updated: 2024-08-06T13:18:48.639Z Vendors: n/a Products: n/a Problem Types: n/a Description: Citrix NetScaler Application Delivery Controller and NetScaler Gateway 10.5.50.10 before 10.5-52.11, 10.1.122.17 before 10.1-129.11, and 10.1-120.1316.e before 10.1-129.1105.e, when using unspecified configurations, allows remote authenticated users to access "network resources" of other users via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - http://support.citrix.com/article/CTX200254 - http://secunia.com/advisories/62114 - https://exchange.xforce.ibmcloud.com/vulnerabilities/98661 - http:/
le/CTX200254 - http://secunia.com/advisories/62114 - https://exchange.xforce.ibmcloud.com/vulnerabilities/98661 - http://www.securitytracker.com/id/1031212
CVE ID: CVE-2014-8582 State: PUBLISHED Published: 2014-11-01T23:00:00 Last Updated: 2024-08-06T13:26:00.755Z Vendors: n/a Products: n/a Problem Types: n/a Description: FortiNet FortiADC-E with firmware 3.1.1 before 4.0.5 and Coyote Point Equalizer with firmware 10.2.0a allows remote attackers to obtain access to arbitrary subnets via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://docs.fortinet.com/uploaded/files/2164/FortiADC-E-4.0.5-GA-Release-Notes.pdf - https://exchange.xforce.ibmcloud.com/vulnerabilities/98384 - http://www.fortiguard.com/advisory/FG-IR-14-032/ - http://secunia.com/advisories/61866
CVE ID: CVE-2014-8583 State: PUBLISHED Published: 2014-12-16T18:00:00 Last Updated: 2024-08-06T13:25:59.935Z Vendors: n/a Products: n/a Problem Types: n/a Description: mod_wsgi before 4.2.4 for Apache, when creating a daemon process group, does not properly handle when group privileges cannot be dropped, which might allow attackers to gain privileges via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1111034 - http://www.securityfocus.com/bid/68111 - http://advisories.mageia.org/MGASA-2014-0513.html - http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.2.4.html - http://www.openwall.com/lists/oss-
13.html - http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.2.4.html - http://www.openwall.com/lists/oss-security/2014/06/19/7 - https://security.gentoo.org/glsa/201612-49 - http://lists.opensuse.org/opensuse-updates/2014-12/msg00036.html - http://www.openwall.com/lists/oss-security/2014/11/04/8 - http://www.mandriva.com/security/advisories?name=MDVSA-2014:253 - http://www.ubuntu.com/usn/USN-2431-1
CVE ID: CVE-2014-8584 State: PUBLISHED Published: 2014-11-04T15:00:00Z Last Updated: 2024-09-16T19:46:26.744Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Web Dorado Spider Video Player (aka WordPress Video Player) plugin before 1.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/player/changelog
CVE ID: CVE-2014-8585 State: PUBLISHED Published: 2014-11-04T15:00:00 Last Updated: 2024-08-06T13:25:59.943Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the WordPress Download Manager plugin for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the fname parameter to (1) views/file_download.php or (2) file_download.php. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/98318 - http://www.securityfocus.com/bid/70764 - http://packetstormsecurity.com/files/128852/WordPress-Download-Manager-Arbitrary-File-Download.html
CVE ID: CVE-2014-8586 State: PUBLISHED Published: 2014-11-04T15:00:00 Last Updated: 2024-08-06T13:25:59.963Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the CP Multi View Event Calendar plugin 1.01 for WordPress allows remote attackers to execute arbitrary SQL commands via the calid parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/70718 - https://exchange.xforce.ibmcloud.com/vulnerabilities/97766 - http://osvdb.org/show/osvdb/113670 - http://www.exploit-db.com/exploits/35073 - http://packetstormsecurity.com/files/128814/WordPress-CP-Multi-View-Event-Calendar-1.01-SQL-Injection.html
CVE ID: CVE-2014-8587 State: PUBLISHED Published: 2014-11-04T15:00:00Z Last Updated: 2024-09-16T20:17:25.356Z Vendors: n/a Products: n/a Problem Types: n/a Description: SAPCRYPTOLIB before 5.555.38, SAPSECULIB, and CommonCryptoLib before 8.4.30, as used in SAP NetWeaver AS for ABAP and SAP HANA, allows remote attackers to spoof Digital Signature Algorithm (DSA) signatures via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://service.sap.com/sap/support/notes/2067859 - http://blog.onapsis.com/sap-security-note-2067859-potential-exposure-to-digital-signature-spoofing/ - https://twitter.com/SAP_Gsupport/status/522401681997570048 - http://secunia.com/ad
sure-to-digital-signature-spoofing/ - https://twitter.com/SAP_Gsupport/status/522401681997570048 - http://secunia.com/advisories/57606
CVE ID: CVE-2014-8588 State: PUBLISHED Published: 2014-11-04T15:00:00 Last Updated: 2024-08-06T13:25:59.923Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in metadata.xsjs in SAP HANA 1.00.60.379371 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://erpscan.io/press-center/blog/sap-critical-patch-update-october-2014/ - https://service.sap.com/sap/support/notes/2067972 - https://erpscan.io/advisories/erpscan-14-013-sap-hana-metadata-xsjs-sql-injection/ - https://exchange.xforce.ibmcloud.com/vulnerabilities/98579
CVE ID: CVE-2014-8589 State: PUBLISHED Published: 2014-11-04T15:00:00 Last Updated: 2024-08-06T13:25:59.906Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow in SAP Network Interface Router (SAProuter) 40.4 allows remote attackers to cause a denial of service (resource consumption) via crafted requests. Additional Analyst Notes: - CVE Program Container: References: - https://twitter.com/SAP_Gsupport/status/522779507372339200 - https://erpscan.io/press-center/blog/sap-critical-patch-update-october-2014/ - https://erpscan.io/advisories/erpscan-14-014-saprouter-integer-overflow-dos/ - http://blog.onapsis.com/analyzing-sap-security-notes-october-2014-edition/ - https:/
4-saprouter-integer-overflow-dos/ - http://blog.onapsis.com/analyzing-sap-security-notes-october-2014-edition/ - https://service.sap.com/sap/support/notes/2037492
CVE ID: CVE-2014-8590 State: PUBLISHED Published: 2014-11-04T15:00:00 Last Updated: 2024-08-06T13:26:00.756Z Vendors: n/a Products: n/a Problem Types: n/a Description: XML external entity (XXE) vulnerability in the Web Service Navigator in SAP NetWeaver Application Server (AS) Java allows remote attackers to access arbitrary files via a crafted request. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/98581 - https://service.sap.com/sap/support/notes/2045176 - http://www.securityfocus.com/bid/71023 - https://erpscan.io/press-center/blog/sap-critical-patch-update-october-2014/ - https://erpscan.io/advisories/erpscan-14-015-s
://erpscan.io/press-center/blog/sap-critical-patch-update-october-2014/ - https://erpscan.io/advisories/erpscan-14-015-sap-netweaver-as-java-xxe/ - http://blog.onapsis.com/analyzing-sap-security-notes-october-2014-edition/
CVE ID: CVE-2014-8591 State: PUBLISHED Published: 2014-11-04T15:00:00 Last Updated: 2024-08-06T13:26:00.807Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in SAP Internet Communication Manager (ICM), as used in SAP NetWeaver 7.02 and 7.3, allows remote attackers to cause a denial of service (process termination) via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - https://erpscan.io/press-center/blog/sap-critical-patch-update-october-2014/ - https://service.sap.com/sap/support/notes/1966655 - https://erpscan.io/advisories/erpscan-14-016-sap-netweaver-httpd-partial-http-post-requests-dos/ - http://blog.onapsis.com/analyzi
pscan.io/advisories/erpscan-14-016-sap-netweaver-httpd-partial-http-post-requests-dos/ - http://blog.onapsis.com/analyzing-sap-security-notes-october-2014-edition/ - https://exchange.xforce.ibmcloud.com/vulnerabilities/98582 - https://twitter.com/SAP_Gsupport/status/524138333065449472 - http://www.securityfocus.com/bid/71030
CVE ID: CVE-2014-8592 State: PUBLISHED Published: 2014-11-04T15:00:00 Last Updated: 2024-08-06T13:26:00.840Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in SAP Host Agent, as used in SAP NetWeaver 7.02 and 7.3, allows remote attackers to cause a denial of service (process termination) via a crafted request. Additional Analyst Notes: - CVE Program Container: References: - https://erpscan.io/press-center/blog/sap-critical-patch-update-october-2014/ - https://service.sap.com/sap/support/notes/1986725 - http://blog.onapsis.com/analyzing-sap-security-notes-october-2014-edition/ - https://erpscan.io/advisories/erpscan-14-021-sap-netweaver-management-console
sap-security-notes-october-2014-edition/ - https://erpscan.io/advisories/erpscan-14-021-sap-netweaver-management-console-gsaop-partial-http-post-requests-dos/ - https://twitter.com/SAP_Gsupport/status/523111735637864448 - https://erpscan.io/advisories/erpscan-14-018-sap-netweaver-j2ee-engine-partial-http-post-requests-dos/ - https://erpscan.io/advisories/erpscan-14-019-sap-netweaver-j2ee-engine-partial-http-post-requests-dos/ - https://erpscan.io/advisories/erpscan-14-017-sap-netweaver-http-partial-http-post-requests-dos/ - https://erpscan.io/advisories/erpscan-14-020-sap-netweaver-management-console-gsaop-partial-http-requests-dos/
CVE ID: CVE-2014-8593 State: PUBLISHED Published: 2014-11-04T16:00:00 Last Updated: 2024-08-06T13:26:00.717Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Allomani Weblinks 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) default URI to admin.php or the (2) id parameter to admin.php or (3) go.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/128565/Allomani-Weblinks-1.0-Cross-Site-Scripting-SQL-Injection.html - http://www.securityfocus.com/bid/70255 - https://exchange.xforce.ibmcloud.com/vulnerabilities/96841
CVE ID: CVE-2014-8594 State: PUBLISHED Published: 2014-11-19T18:00:00 Last Updated: 2024-08-06T13:25:59.938Z Vendors: n/a Products: n/a Problem Types: n/a Description: The do_mmu_update function in arch/x86/mm.c in Xen 4.x through 4.4.x does not properly restrict updates to only PV page tables, which allows remote PV guests to cause a denial of service (NULL pointer dereference) by leveraging hardware emulation services for HVM guests using Hardware Assisted Paging (HAP). Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201504-04 - http://secunia.com/advisories/62672 - http://xenbits.xen.org/xsa/advisory-109.html - http://www.securityfocus.com
4-04 - http://secunia.com/advisories/62672 - http://xenbits.xen.org/xsa/advisory-109.html - http://www.securityfocus.com/bid/71149 - http://www.debian.org/security/2015/dsa-3140 - http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00005.html - http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00010.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/98767
CVE ID: CVE-2014-8595 State: PUBLISHED Published: 2014-11-19T18:00:00 Last Updated: 2024-08-06T13:25:59.956Z Vendors: n/a Products: n/a Problem Types: n/a Description: arch/x86/x86_emulate/x86_emulate.c in Xen 3.2.1 through 4.4.x does not properly check privileges, which allows local HVM guest users to gain privileges or cause a denial of service (crash) via a crafted (1) CALL, (2) JMP, (3) RETF, (4) LCALL, (5) LJMP, or (6) LRET far branch instruction. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201504-04 - http://secunia.com/advisories/62672 - http://support.citrix.com/article/CTX201794 - http://support.citrix.com/article/CTX200288 - htt
a.com/advisories/62672 - http://support.citrix.com/article/CTX201794 - http://support.citrix.com/article/CTX200288 - http://www.debian.org/security/2015/dsa-3140 - http://secunia.com/advisories/62537 - http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00005.html - http://www.securityfocus.com/bid/71151 - http://xenbits.xen.org/xsa/advisory-110.html - http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00010.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/98768
CVE ID: CVE-2014-8596 State: PUBLISHED Published: 2014-11-17T16:00:00 Last Updated: 2024-08-06T13:26:00.832Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in PHP-Fusion 7.02.07 allow remote authenticated users to execute arbitrary SQL commands via the (1) submit_id parameter in a 2 action to files/administration/submissions.php or (2) status parameter to files/administration/members.php. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/98583 - http://packetstormsecurity.com/files/133869/PHP-Fusion-7.02.07-Blind-SQL-Injection.html - http://osvdb.org/show/osvdb/112419 - http
etstormsecurity.com/files/133869/PHP-Fusion-7.02.07-Blind-SQL-Injection.html - http://osvdb.org/show/osvdb/112419 - http://www.exploit-db.com/exploits/35206 - http://www.securityfocus.com/bid/71053 - https://www.xlabs.com.br/blog/?p=282 - http://packetstormsecurity.com/files/129053/PHP-Fusion-7.02.07-SQL-Injection.html - http://seclists.org/fulldisclosure/2015/Oct/23
CVE ID: CVE-2014-8597 State: PUBLISHED Published: 2022-02-17T19:10:01 Last Updated: 2024-08-06T13:25:59.967Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected cross-site scripting (XSS) vulnerability in PHP-Fusion 7.02.07 allows remote attackers to inject arbitrary web script or HTML via the status parameter in the CMS admin panel. Additional Analyst Notes: - CVE Program Container: References: - https://www.xlabs.com.br/blog/cve-2014-8597-php-fusion-xss-injection-reflected/
CVE ID: CVE-2014-8598 State: PUBLISHED Published: 2014-11-18T15:00:00 Last Updated: 2024-08-06T13:25:59.956Z Vendors: n/a Products: n/a Problem Types: n/a Description: The XML Import/Export plugin in MantisBT 1.2.x does not restrict access, which allows remote attackers to (1) upload arbitrary XML files via the import page or (2) obtain sensitive information via the export page. NOTE: this issue can be combined with CVE-2014-7146 to execute arbitrary PHP code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mantisbt/mantisbt/commit/80a15487 - http://www.openwall.com/lists/oss-security/2014/11/07/28 - https://exchange.xforce.ibmcloud.com/vulnerabilities/985
87 - http://www.openwall.com/lists/oss-security/2014/11/07/28 - https://exchange.xforce.ibmcloud.com/vulnerabilities/98573 - http://www.securityfocus.com/bid/70996 - http://www.mantisbt.org/bugs/view.php?id=17780 - http://secunia.com/advisories/62101 - http://www.debian.org/security/2015/dsa-3120
CVE ID: CVE-2014-8600 State: PUBLISHED Published: 2014-12-08T11:00:00 Last Updated: 2024-08-06T13:26:00.973Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in KDE-Runtime 4.14.3 and earlier, kwebkitpart 1.3.4 and earlier, and kio-extras 5.1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via a crafted URI using the (1) zip, (2) trash, (3) tar, (4) thumbnail, (5) smtps, (6) smtp, (7) smb, (8) remote, (9) recentdocuments, (10) nntps, (11) nntp, (12) network, (13) mbox, (14) ldaps, (15) ldap, (16) fonts, (17) file, (18) desktop, (19) cgi, (20) bookmarks, or (21) ar scheme, which is not properly handled i