Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2014-3835 State: PUBLISHED Published: 2014-06-04T14:00:00 Last Updated: 2024-08-06T10:57:18.008Z Vendors: n/a Products: n/a Problem Types: n/a Description: ownCloud Server before 5.0.16 and 6.0.x before 6.0.3 does not check permissions to the files_external application, which allows remote authenticated users to add external storage via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://owncloud.org/about/security/advisories/oc-sa-2014-012/
CVE ID: CVE-2014-3836 State: PUBLISHED Published: 2014-06-04T14:00:00 Last Updated: 2024-08-06T10:57:17.385Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in ownCloud Server before 6.0.3 allow remote attackers to hijack the authentication of users for requests that (1) conduct cross-site scripting (XSS) attacks, (2) modify files, or (3) rename files via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://owncloud.org/about/security/advisories/oc-sa-2014-014/
CVE ID: CVE-2014-3837 State: PUBLISHED Published: 2014-06-04T14:00:00 Last Updated: 2024-08-06T10:57:17.570Z Vendors: n/a Products: n/a Problem Types: n/a Description: The document application in ownCloud Server before 6.0.3 uses sequential values for the file_id, which allows remote authenticated users to enumerate shared files via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://owncloud.org/about/security/advisories/oc-sa-2014-015/
CVE ID: CVE-2014-3838 State: PUBLISHED Published: 2014-06-04T14:00:00 Last Updated: 2024-08-06T10:57:17.552Z Vendors: n/a Products: n/a Problem Types: n/a Description: ownCloud Server before 5.0.16 and 6.0.x before 6.0.3 does not properly check permissions, which allows remote authenticated users to read the names of files of other users by leveraging access to multiple accounts. Additional Analyst Notes: - CVE Program Container: References: - http://owncloud.org/about/security/advisories/oc-sa-2014-016/
CVE ID: CVE-2014-3840 State: PUBLISHED Published: 2014-05-27T14:00:00 Last Updated: 2024-08-06T10:57:17.369Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in apps/common/templates/calculate_form_title.html in Mayan EDMS 0.13 allow remote authenticated users to inject arbitrary web script or HTML via a (1) tag or the (2) title of a source in a Staging folder, (3) Name field in a bootstrap setup, or Title field in a (4) smart link or (5) web form. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/oss-sec/2014/q2/352 - https://github.com/mayan-edms/mayan-edms/issues/3 - http://seclists.org/oss-se
http://seclists.org/oss-sec/2014/q2/352 - https://github.com/mayan-edms/mayan-edms/issues/3 - http://seclists.org/oss-sec/2014/q2/349 - http://research.openflare.org/advisories/OF-2014-09/mayan-edbs-storedxss.txt - http://www.exploit-db.com/exploits/33493 - http://research.openflare.org/poc/maya-edms/maya-edms_multiple_xss.avi - http://www.securityfocus.com/bid/67552 - https://github.com/mayan-edms/mayan-edms/commit/398c480c10416d76e7c1dcb607e726e8fc988e72
CVE ID: CVE-2014-3841 State: PUBLISHED Published: 2014-05-22T15:00:00Z Last Updated: 2024-09-16T18:49:39.276Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Contact Bank plugin before 2.0.20 for WordPress allows remote attackers to inject arbitrary web script or HTML via the Label field, related to form layout configuration. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://wordpress.org/plugins/contact-bank/changelog - http://www.securityfocus.com/bid/67334 - http://secunia.com/advisories/58300
CVE ID: CVE-2014-3842 State: PUBLISHED Published: 2014-05-22T15:00:00Z Last Updated: 2024-09-17T00:06:47.466Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the iMember360 plugin 3.8.012 through 3.9.001 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) decrypt or (2) encrypt parameter. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/58094 - http://packetstormsecurity.com/files/126324/WordPress-iMember360is-3.9.001-XSS-Disclosure-Code-Execution.html - http://www.exploit-db.com/exploits/33076 - http://osvdb.org/show/osvdb/106299 - http://seclis
sure-Code-Execution.html - http://www.exploit-db.com/exploits/33076 - http://osvdb.org/show/osvdb/106299 - http://seclists.org/fulldisclosure/2014/Apr/265
CVE ID: CVE-2014-3843 State: PUBLISHED Published: 2014-05-22T15:00:00Z Last Updated: 2024-09-16T16:18:24.916Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in the Search Everything plugin before 8.1.1 for WordPress allows remote attackers to hijack the authentication of unspecified victims via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - http://wordpress.org/plugins/search-everything/changelog - http://secunia.com/advisories/58502
CVE ID: CVE-2014-3844 State: PUBLISHED Published: 2014-05-22T15:00:00Z Last Updated: 2024-09-16T18:02:47.623Z Vendors: n/a Products: n/a Problem Types: n/a Description: The TinyMCE Color Picker plugin before 1.2 for WordPress does not properly check permissions, which allows remote attackers to modify plugin settings via unspecified vectors. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://wordpress.org/plugins/tinymce-colorpicker/changelog - http://secunia.com/advisories/58095
CVE ID: CVE-2014-3845 State: PUBLISHED Published: 2014-05-22T15:00:00Z Last Updated: 2024-09-17T02:46:33.007Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in the TinyMCE Color Picker plugin before 1.2 for WordPress allows remote attackers to hijack the authentication of unspecified users for requests that change plugin settings via unknown vectors. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://wordpress.org/plugins/tinymce-colorpicker/changelog - http://secunia.com/advisories/58095
CVE ID: CVE-2014-3846 State: PUBLISHED Published: 2014-05-22T15:00:00Z Last Updated: 2024-09-17T03:43:34.228Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Flying Cart allows remote attackers to inject arbitrary web script or HTML via the p parameter to index.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/67529 - http://packetstormsecurity.com/files/126735/flyingcart-xss.txt
CVE ID: CVE-2014-3848 State: PUBLISHED Published: 2014-05-23T14:00:00Z Last Updated: 2024-09-16T20:57:45.545Z Vendors: n/a Products: n/a Problem Types: n/a Description: The iMember360 plugin before 3.9.001 for WordPress does not properly restrict access, which allows remote attackers to obtain database credentials via the i4w_dbinfo parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/126324/WordPress-iMember360is-3.9.001-XSS-Disclosure-Code-Execution.html - http://www.exploit-db.com/exploits/33076 - http://www.osvdb.org/106298 - http://seclists.org/fulldisclosure/2014/Apr/265 - http://releases.imember360.com/
CVE ID: CVE-2014-3849 State: PUBLISHED Published: 2014-05-23T14:00:00Z Last Updated: 2024-09-17T03:13:42.907Z Vendors: n/a Products: n/a Problem Types: n/a Description: The iMember360 plugin 3.8.012 through 3.9.001 for WordPress does not properly restrict access, which allows remote attackers to delete arbitrary users via a request containing a user name in the Email parameter and the API key in the i4w_clearuser parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/126324/WordPress-iMember360is-3.9.001-XSS-Disclosure-Code-Execution.html - http://www.exploit-db.com/exploits/33076 - http://www.osvdb.org/106300 - http://seclists.org/fu
re-Code-Execution.html - http://www.exploit-db.com/exploits/33076 - http://www.osvdb.org/106300 - http://seclists.org/fulldisclosure/2014/Apr/265
CVE ID: CVE-2014-3850 State: PUBLISHED Published: 2014-06-11T14:00:00 Last Updated: 2024-08-06T10:57:17.511Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in the Member Approval plugin 131109 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings to their default and disable registration approval via a request to wp-admin/options-general.php. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2014/Jun/63 - https://security.dxw.com/advisories/csrf-in-member-approval-131109-permits-unapproved-registrations
CVE ID: CVE-2014-3851 State: PUBLISHED Published: 2014-08-07T10:00:00 Last Updated: 2024-08-06T10:57:17.570Z Vendors: n/a Products: n/a Problem Types: n/a Description: usr/lib/cgi-bin/create_passwd_file.py in Pyplate 0.08 uses world-readable permissions for passwd.db, which allows local users to obtain the administrator password by reading this file. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2014/05/23/1 - http://www.openwall.com/lists/oss-security/2014/05/14/3
CVE ID: CVE-2014-3852 State: PUBLISHED Published: 2014-08-07T10:00:00 Last Updated: 2024-08-06T10:57:17.792Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pyplate 0.08 does not include the HTTPOnly flag in a Set-Cookie header for the id cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2014/05/23/1 - http://www.openwall.com/lists/oss-security/2014/05/14/3
CVE ID: CVE-2014-3853 State: PUBLISHED Published: 2014-08-07T10:00:00 Last Updated: 2024-08-06T10:57:17.540Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pyplate 0.08 does not set the secure flag for the id cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2014/05/23/1 - http://www.openwall.com/lists/oss-security/2014/05/14/3
CVE ID: CVE-2014-3854 State: PUBLISHED Published: 2014-08-07T10:00:00 Last Updated: 2024-08-06T10:57:17.744Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in admin/addScript.py in Pyplate 0.08 allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the title parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2014/05/23/1 - http://www.openwall.com/lists/oss-security/2014/05/14/3
CVE ID: CVE-2014-3855 State: PUBLISHED Published: 2014-08-07T10:00:00 Last Updated: 2024-08-06T10:57:17.669Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in download.py in Pyplate 0.08 allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2014/05/23/1 - http://www.openwall.com/lists/oss-security/2014/05/14/3
CVE ID: CVE-2014-3856 State: PUBLISHED Published: 2020-01-28T15:30:30 Last Updated: 2024-08-06T10:57:17.381Z Vendors: n/a Products: n/a Problem Types: n/a Description: The funced function in fish (aka fish-shell) 1.23.0 before 2.1.1 does not properly create temporary files, which allows local users to gain privileges via a temporary file with a predictable name. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fish-shell/fish-shell/issues/1437 - https://github.com/fish-shell/fish-shell/releases/tag/2.1.1 - https://www.openwall.com/lists/oss-security/2014/04/28/4
CVE ID: CVE-2014-3857 State: PUBLISHED Published: 2014-07-03T14:00:00 Last Updated: 2024-08-06T10:57:17.634Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in Kerio Control Statistics in Kerio Control (formerly WinRoute Firewall) before 8.3.2 allow remote authenticated users to execute arbitrary SQL commands via the (1) x_16 or (2) x_17 parameter to print.php. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/59215 - http://www.exploit-db.com/exploits/33954 - http://www.kerio.com/support/kerio-control/release-history - http://packetstormsecurity.com/files/127320/Kerio-Control-8.3.1-Blind-SQL-Injec
/support/kerio-control/release-history - http://packetstormsecurity.com/files/127320/Kerio-Control-8.3.1-Blind-SQL-Injection.html - http://www.securityfocus.com/archive/1/532607/100/0/threaded - http://fereidani.com/articles/show/76_kerio_control_8_3_1_boolean_based_blind_sql_injection - http://osvdb.org/show/osvdb/108584
CVE ID: CVE-2014-3859 State: PUBLISHED Published: 2014-06-13T10:00:00 Last Updated: 2024-08-06T10:57:17.637Z Vendors: n/a Products: n/a Problem Types: n/a Description: libdns in ISC BIND 9.10.0 before P2 does not properly handle EDNS options, which allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via a crafted packet, as demonstrated by an attack against named, dig, or delv. Additional Analyst Notes: - CVE Program Container: References: - https://kb.isc.org/article/AA-01166/ - http://www.securityfocus.com/bid/68193 - https://kb.isc.org/article/AA-01171/ - http://secunia.com/advisories/58946 - http://www.securitytracker.com/id/1030414
CVE ID: CVE-2014-3860 State: PUBLISHED Published: 2020-02-12T17:56:53 Last Updated: 2024-08-06T10:57:17.634Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xilisoft Video Converter Ultimate 7.8.1 build-20140505 has a DLL Hijacking vulnerability Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/126882/Xilisoft-Video-Converter-Ultimate-7.8.1-build-20140505-DLL-Hijacking.html
CVE ID: CVE-2014-3861 State: PUBLISHED Published: 2014-09-02T10:00:00 Last Updated: 2024-08-06T10:57:17.682Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in CDA.xsl in HL7 C-CDA 1.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted reference element within a nonXMLBody element. Additional Analyst Notes: - CVE Program Container: References: - http://motorcycleguy.blogspot.com/2014/04/hl7-cda-stylesheet-patches.html - http://gforge.hl7.org/gf/project/strucdoc/frs/?action=FrsReleaseView&release_id=1088 - http://smartplatforms.org/2014/04/security-vulnerabilities-in-ccda-display/
CVE ID: CVE-2014-3862 State: PUBLISHED Published: 2014-09-02T10:00:00 Last Updated: 2024-08-06T10:57:17.866Z Vendors: n/a Products: n/a Problem Types: n/a Description: CDA.xsl in HL7 C-CDA 1.1 and earlier allows remote attackers to discover potentially sensitive URLs via a crafted reference element that triggers creation of an IMG element with an arbitrary URL in its SRC attribute, leading to information disclosure in a Referer log. Additional Analyst Notes: - CVE Program Container: References: - http://motorcycleguy.blogspot.com/2014/04/hl7-cda-stylesheet-patches.html - http://gforge.hl7.org/gf/project/strucdoc/frs/?action=FrsReleaseView&release_id=1088 - http://smartplatforms.org/2014/04/s
tp://gforge.hl7.org/gf/project/strucdoc/frs/?action=FrsReleaseView&release_id=1088 - http://smartplatforms.org/2014/04/security-vulnerabilities-in-ccda-display/
CVE ID: CVE-2014-3863 State: PUBLISHED Published: 2014-10-20T18:00:00 Last Updated: 2024-08-06T10:57:17.619Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the JChatSocial component before 2.3 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the filename parameter in a file upload in an active JChat chat window. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/68424 - http://www.securityfocus.com/archive/1/532662/100/0/threaded - http://packetstormsecurity.com/files/127372/Joomla-JChatSocial-2.2-Cross-Site-Scripting.html
CVE ID: CVE-2014-3864 State: PUBLISHED Published: 2014-05-30T18:00:00 Last Updated: 2024-08-06T10:57:17.618Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in dpkg-source in dpkg-dev 1.3.0 allows remote attackers to modify files outside of the intended directories via a crafted source package that lacks a --- header line. Additional Analyst Notes: - CVE Program Container: References: - http://www.ubuntu.com/usn/USN-2242-1 - http://www.debian.org/security/2014/dsa-2953 - http://openwall.com/lists/oss-security/2014/05/25/2 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=746498 - http://www.securityfocus.com/bid/67725
CVE ID: CVE-2014-3865 State: PUBLISHED Published: 2014-05-30T18:00:00 Last Updated: 2024-08-06T10:57:17.636Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple directory traversal vulnerabilities in dpkg-source in dpkg-dev 1.3.0 allow remote attackers to modify files outside of the intended directories via a source package with a crafted Index: pseudo-header in conjunction with (1) missing --- and +++ header lines or (2) a +++ header line with a blank pathname. Additional Analyst Notes: - CVE Program Container: References: - http://www.ubuntu.com/usn/USN-2242-1 - http://www.debian.org/security/2014/dsa-2953 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=749183 - http://
42-1 - http://www.debian.org/security/2014/dsa-2953 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=749183 - http://openwall.com/lists/oss-security/2014/05/25/2 - http://www.securityfocus.com/bid/67727
CVE ID: CVE-2014-3866 State: PUBLISHED Published: 2014-05-26T19:00:00 Last Updated: 2024-08-06T10:57:18.067Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in user_settings.php in Usercake 2.0.2 and earlier allow remote attackers to hijack the authentication of administrators for requests that change the (1) administrative password via the passwordc parameter or (2) administrative e-mail address via the email parameter. Additional Analyst Notes: - CVE Program Container: References: - http://research.openflare.org/advisories/OF-2014-11/usercake_csrf.txt
CVE ID: CVE-2014-3867 State: PUBLISHED Published: 2014-05-26T10:00:00 Last Updated: 2024-08-06T10:57:17.840Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 does not include the HTTPOnly flag in a Set-Cookie header for an unspecified cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie, a different vulnerability than CVE-2013-3984. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/67659 - https://exchange.xforce.ibmcloud.com/vulnerabilities/84967 - http://www-01.ibm.com/support/docv
ityfocus.com/bid/67659 - https://exchange.xforce.ibmcloud.com/vulnerabilities/84967 - http://www-01.ibm.com/support/docview.wss?uid=swg21671201
CVE ID: CVE-2014-3868 State: PUBLISHED Published: 2020-01-31T21:07:19 Last Updated: 2024-08-06T10:57:17.886Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in ZeusCart 4.x. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/127196/ZeusCart-4.x-Remote-SQL-Injection.html - https://github.com/ZeusCart/zeuscart/pull/23 - http://seclists.org/fulldisclosure/2014/Jun/116 - http://www.securityfocus.com/bid/68182
CVE ID: CVE-2014-3870 State: PUBLISHED Published: 2014-05-27T14:00:00Z Last Updated: 2024-09-16T16:38:09.458Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the bib2html plugin 0.9.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the styleShortName parameter in an adminStyleAdd action to OSBiB/create/index.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/67589 - http://packetstormsecurity.com/files/126782/wpbib2html-xss.txt
CVE ID: CVE-2014-3871 State: PUBLISHED Published: 2014-05-27T14:00:00 Last Updated: 2024-08-06T10:57:18.064Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in register.php in Geodesic Solutions GeoCore MAX 7.3.3 (formerly GeoClassifieds and GeoAuctions) allow remote attackers to execute arbitrary SQL commands via the (1) c[password] or (2) c[username] parameter. NOTE: the b parameter to index.php vector is already covered by CVE-2006-3823. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/show/osvdb/106364 - http://geodesicsolutions.com/changelog/7.3/changelog.html - http://www.securityfocus.com/bid/67078 - ht
w/osvdb/106364 - http://geodesicsolutions.com/changelog/7.3/changelog.html - http://www.securityfocus.com/bid/67078 - http://secunia.com/advisories/58308 - http://packetstormsecurity.com/files/126329/GeoCore-MAX-DB-7.3.3-Blind-SQL-Injection.html - http://www.exploit-db.com/exploits/33075
CVE ID: CVE-2014-3872 State: PUBLISHED Published: 2014-05-27T14:00:00 Last Updated: 2024-08-06T10:57:17.933Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in the administration login page in D-Link DAP-1350 (Rev. A1) with firmware 1.14 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/58254 - http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10023 - http://www.securityfocus.com/bid/67310
CVE ID: CVE-2014-3873 State: PUBLISHED Published: 2014-06-10T14:00:00 Last Updated: 2024-08-06T10:57:17.935Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ktrace utility in the FreeBSD kernel 8.4 before p11, 9.1 before p14, 9.2 before p7, and 9.3-BETA1 before p1 uses an incorrect page fault kernel trace entry size, which allows local users to obtain sensitive information from kernel memory via a kernel process trace. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/67812 - http://www.freebsd.org/security/advisories/FreeBSD-SA-14%3A12.ktrace.asc - http://www.securitytracker.com/id/1030325 - http://secunia.com/advisories/58627
CVE ID: CVE-2014-3875 State: PUBLISHED Published: 2019-11-27T18:35:08 Last Updated: 2024-08-06T10:57:17.940Z Vendors: n/a Products: n/a Problem Types: n/a Description: The addto parameter to fup in Frams' Fast File EXchange (F*EX, aka fex) before fex-2014053 allows remote attackers to conduct cross-site scripting (XSS) attacks Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/126906/F-EX-20140313-1-HTTP-Response-Splitting-Cross-Site-Scripting.html - https://security-tracker.debian.org/tracker/CVE-2014-3875 - http://www.openwall.com/lists/oss-security/2014/06/03/6 - http://seclists.org/fulldisclosure/2014/Jun/1 - http://www.securityfocus.com
nwall.com/lists/oss-security/2014/06/03/6 - http://seclists.org/fulldisclosure/2014/Jun/1 - http://www.securityfocus.com/bid/67783