Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2014-3526 State: PUBLISHED Published: 2017-10-30T14:00:00 Last Updated: 2024-08-06T10:50:16.801Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apache Wicket before 1.5.12, 6.x before 6.17.0, and 7.x before 7.0.0-M3 might allow remote attackers to obtain sensitive information via vectors involving identifiers for storing page markup for temporary user sessions. Additional Analyst Notes: - CVE Program Container: References: - https://wicket.apache.org/news/2014/09/22/cve-2014-3526.html
CVE ID: CVE-2014-3527 State: PUBLISHED Published: 2017-05-25T17:00:00 Last Updated: 2024-08-06T10:50:16.372Z Vendors: Pivotal Products: Spring Security Problem Types: Access Control Bypass Description: When using the CAS Proxy ticket authentication from Spring Security 3.1 to 3.2.4 a malicious CAS Service could trick another CAS Service into authenticating a proxy ticket that was not associated. This is due to the fact that the proxy ticket authentication uses the information from the HttpServletRequest which is populated based upon untrusted information within the HTTP request. This means if there are access control restrictions on which CAS services can authenticate to one another, those r
uest. This means if there are access control restrictions on which CAS services can authenticate to one another, those restrictions can be bypassed. If users are not using CAS Proxy tickets and not basing access control decisions based upon the CAS Service, then there is no impact to users. Additional Analyst Notes: - CVE Program Container: References: - https://pivotal.io/security/cve-2014-3527
CVE ID: CVE-2014-3528 State: PUBLISHED Published: 2014-08-19T18:00:00 Last Updated: 2024-08-06T10:50:16.884Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL and authentication realm to store cached credentials, which makes it easier for remote servers to obtain the credentials via a crafted authentication realm. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/59432 - http://www.ubuntu.com/usn/USN-2316-1 - http://rhn.redhat.com/errata/RHSA-2015-0166.html - https://support.apple.com/HT204427 - http://www.securityfocus.com/bid/68995 -
n.redhat.com/errata/RHSA-2015-0166.html - https://support.apple.com/HT204427 - http://www.securityfocus.com/bid/68995 - http://subversion.apache.org/security/CVE-2014-3528-advisory.txt - http://lists.apple.com/archives/security-announce/2015/Mar/msg00003.html - http://rhn.redhat.com/errata/RHSA-2015-0165.html - http://secunia.com/advisories/60722 - http://lists.opensuse.org/opensuse-updates/2014-08/msg00038.html - https://security.gentoo.org/glsa/201610-05 - http://secunia.com/advisories/59584 - http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
CVE ID: CVE-2014-3529 State: PUBLISHED Published: 2014-09-04T17:00:00 Last Updated: 2024-08-06T10:50:16.343Z Vendors: n/a Products: n/a Problem Types: n/a Description: The OPC SAX setup in Apache POI before 3.10.1 allows remote attackers to read arbitrary files via an OpenXML file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg21996759 - http://poi.apache.org/changes.html - http://www.securityfocus.com/bid/78018 - http://secunia.com/advisories/61766 - https://lucene.apache.org/solr/solrnews.htm
tp://www.securityfocus.com/bid/78018 - http://secunia.com/advisories/61766 - https://lucene.apache.org/solr/solrnews.html#18-august-2014-recommendation-to-update-apache-poi-in-apache-solr-480-481-and-490-installations - https://exchange.xforce.ibmcloud.com/vulnerabilities/95770 - http://rhn.redhat.com/errata/RHSA-2014-1370.html - http://www.apache.org/dist/poi/release/RELEASE-NOTES.txt - http://secunia.com/advisories/60419 - http://rhn.redhat.com/errata/RHSA-2014-1400.html - http://www.securityfocus.com/bid/69647 - http://rhn.redhat.com/errata/RHSA-2014-1398.html - http://secunia.com/advisories/59943 - http://rhn.redhat.com/errata/RHSA-2014-1399.html
CVE ID: CVE-2014-3530 State: PUBLISHED Published: 2014-07-22T20:00:00 Last Updated: 2024-08-06T10:50:16.323Z Vendors: n/a Products: n/a Problem Types: n/a Description: The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 5.2.0 and 6.2.4, expands entity references, which allows remote attackers to read arbitrary code and possibly have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2014-0886.html - http://rhn.redhat.com/errata/RHSA-2014-0885.htm
tainer: References: - http://rhn.redhat.com/errata/RHSA-2014-0886.html - http://rhn.redhat.com/errata/RHSA-2014-0885.html - http://rhn.redhat.com/errata/RHSA-2015-0765.html - http://secunia.com/advisories/60124 - http://rhn.redhat.com/errata/RHSA-2015-0675.html - http://rhn.redhat.com/errata/RHSA-2015-0720.html - http://rhn.redhat.com/errata/RHSA-2014-0884.html - http://rhn.redhat.com/errata/RHSA-2015-1888.html - http://rhn.redhat.com/errata/RHSA-2015-0091.html - http://secunia.com/advisories/60047 - http://rhn.redhat.com/errata/RHSA-2014-0883.html - http://www.securitytracker.com/id/1030607 - https://exchange.xforce.ibmcloud.com/vulnerabilities/94700
CVE ID: CVE-2014-3531 State: PUBLISHED Published: 2017-10-18T14:00:00 Last Updated: 2024-08-06T10:50:16.852Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Foreman before 1.5.2 allow remote authenticated users to inject arbitrary web script or HTML via the operating system (1) name or (2) description. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/theforeman/foreman/pull/1580 - http://projects.theforeman.org/issues/6580 - https://theforeman.org/security.html#2014-3531 - https://bugzilla.redhat.com/show_bug.cgi?id=1108745
CVE ID: CVE-2014-3532 State: PUBLISHED Published: 2014-07-19T19:00:00 Last Updated: 2024-08-06T10:50:16.897Z Vendors: n/a Products: n/a Problem Types: n/a Description: dbus 1.3.0 before 1.6.22 and 1.8.x before 1.8.6, when running on Linux 2.6.37-rc4 or later, allows local users to cause a denial of service (system-bus disconnect of other services or applications) by sending a message containing a file descriptor, then exceeding the maximum recursion depth before the initial message is forwarded. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/59798 - http://secunia.com/advisories/59611 - http://lists.opensuse.org/opensuse-updates/2014-09/msg0004
.com/advisories/59798 - http://secunia.com/advisories/59611 - http://lists.opensuse.org/opensuse-updates/2014-09/msg00049.html - http://secunia.com/advisories/60236 - http://advisories.mageia.org/MGASA-2014-0294.html - https://bugs.freedesktop.org/show_bug.cgi?id=80163 - http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html - http://www.debian.org/security/2014/dsa-2971 - http://openwall.com/lists/oss-security/2014/07/02/4 - http://www.mandriva.com/security/advisories?name=MDVSA-2015:176
CVE ID: CVE-2014-3533 State: PUBLISHED Published: 2014-07-19T19:00:00 Last Updated: 2024-08-06T10:50:16.803Z Vendors: n/a Products: n/a Problem Types: n/a Description: dbus 1.3.0 before 1.6.22 and 1.8.x before 1.8.6 allows local users to cause a denial of service (disconnect) via a certain sequence of crafted messages that cause the dbus-daemon to forward a message containing an invalid file descriptor. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/59798 - http://secunia.com/advisories/59611 - http://lists.opensuse.org/opensuse-updates/2014-09/msg00049.html - http://secunia.com/advisories/60236 - https://bugs.freedesktop.org/show_bug.cgi?id=80
se-updates/2014-09/msg00049.html - http://secunia.com/advisories/60236 - https://bugs.freedesktop.org/show_bug.cgi?id=80469 - http://advisories.mageia.org/MGASA-2014-0294.html - http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html - http://www.debian.org/security/2014/dsa-2971 - https://bugs.freedesktop.org/show_bug.cgi?id=79694 - http://openwall.com/lists/oss-security/2014/07/02/4 - http://www.mandriva.com/security/advisories?name=MDVSA-2015:176
CVE ID: CVE-2014-3534 State: PUBLISHED Published: 2014-08-01T10:00:00 Last Updated: 2024-08-06T10:50:16.887Z Vendors: n/a Products: n/a Problem Types: n/a Description: arch/s390/kernel/ptrace.c in the Linux kernel before 3.15.8 on the s390 platform does not properly restrict address-space control operations in PTRACE_POKEUSR_AREA requests, which allows local users to obtain read and write access to kernel memory locations, and consequently gain privileges, via a crafted application that makes a ptrace system call. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/95069 - https://bugzilla.redhat.com/show_bug.cgi?id=1114089 -
s: - https://exchange.xforce.ibmcloud.com/vulnerabilities/95069 - https://bugzilla.redhat.com/show_bug.cgi?id=1114089 - http://secunia.com/advisories/59790 - http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.15.8 - http://www.securityfocus.com/bid/68940 - https://github.com/torvalds/linux/commit/dab6cf55f81a6e16b8147aed9a843e1691dcd318 - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=dab6cf55f81a6e16b8147aed9a843e1691dcd318 - http://www.securitytracker.com/id/1030683 - http://www.osvdb.org/109546 - http://www.debian.org/security/2014/dsa-2992 - http://secunia.com/advisories/60351
CVE ID: CVE-2014-3535 State: PUBLISHED Published: 2014-09-28T19:00:00 Last Updated: 2024-08-06T10:50:18.015Z Vendors: n/a Products: n/a Problem Types: n/a Description: include/linux/netdevice.h in the Linux kernel before 2.6.36 incorrectly uses macros for netdev_printk and its related logging implementation, which allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) by sending invalid packets to a VxLAN interface. Additional Analyst Notes: - CVE Program Container: References: - http://mirror.linux.org.au/linux/kernel/v2.6/ChangeLog-2.6.36 - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=256df2f3879efdb2e9808bdb1b54b
g-2.6.36 - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=256df2f3879efdb2e9808bdb1b54b16fbb11fa38 - http://www.securityfocus.com/bid/69721 - https://bugzilla.redhat.com/show_bug.cgi?id=1114540 - https://github.com/torvalds/linux/commit/256df2f3879efdb2e9808bdb1b54b16fbb11fa38
CVE ID: CVE-2014-3536 State: PUBLISHED Published: 2019-12-15T21:04:27 Last Updated: 2024-08-06T10:50:16.932Z Vendors: CFME (CloudForms Management Engine) Products: CFME (CloudForms Management Engine) Problem Types: RHN account info logged to top_output.log during registration Description: CFME (CloudForms Management Engine) 5: RHN account information is logged to top_output.log during registration Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-3536 - https://access.redhat.com/security/cve/cve-2014-3536
CVE ID: CVE-2014-3537 State: PUBLISHED Published: 2014-07-23T14:00:00 Last Updated: 2024-08-06T10:50:16.895Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web interface in CUPS before 1.7.4 allows local users in the lp group to read arbitrary files via a symlink attack on a file in /var/cache/cups/rss/. Additional Analyst Notes: - CVE Program Container: References: - http://lists.fedoraproject.org/pipermail/package-announce/2014-July/135528.html - http://secunia.com/advisories/60273 - http://www.cups.org/blog.php?L724 - http://rhn.redhat.com/errata/RHSA-2014-1388.html - http://www.ubuntu.com/usn/USN-2293-1 - http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html -
4-1388.html - http://www.ubuntu.com/usn/USN-2293-1 - http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html - http://www.securityfocus.com/bid/68788 - http://secunia.com/advisories/60787 - http://www.cups.org/str.php?L4450 - https://bugzilla.redhat.com/show_bug.cgi?id=1115576 - http://secunia.com/advisories/59945 - https://support.apple.com/kb/HT6535 - http://www.securitytracker.com/id/1030611 - http://advisories.mageia.org/MGASA-2014-0313.html - http://www.mandriva.com/security/advisories?name=MDVSA-2015:108
CVE ID: CVE-2014-3538 State: PUBLISHED Published: 2014-07-03T14:00:00 Last Updated: 2024-08-06T10:50:16.893Z Vendors: n/a Products: n/a Problem Types: n/a Description: file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted file that triggers backtracking during processing of an awk rule. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7345. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/file/file/commit/74cafd7de9ec99a14f4480927580e501c8f852c3 - https://github.com/file/file/commit/71a8b6c0d758acb0f73e2e51
file/file/commit/74cafd7de9ec99a14f4480927580e501c8f852c3 - https://github.com/file/file/commit/71a8b6c0d758acb0f73e2e51421a711b5e9d6668 - https://support.apple.com/HT204659 - http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html - http://rhn.redhat.com/errata/RHSA-2014-1766.html - http://www.debian.org/security/2014/dsa-3021 - https://bugzilla.redhat.com/show_bug.cgi?id=1098222 - http://rhn.redhat.com/errata/RHSA-2016-0760.html - http://www.securityfocus.com/bid/68348 - https://github.com/file/file/commit/4a284c89d6ef11aca34da65da7d673050a5ea320 - http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html - http://www.oracle.com/technetwork/top
20 - http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html - http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html - http://openwall.com/lists/oss-security/2014/06/30/7 - http://mx.gw.com/pipermail/file/2014/001553.html - http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html - http://www.debian.org/security/2014/dsa-3008 - http://rhn.redhat.com/errata/RHSA-2014-1327.html - http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html - http://rhn.redhat.com/errata/RHSA-2014-1765.html - https://github.com/file/file/commit/69a5a43b3b71f53b0577f41264a073f495799610 - http://secunia.com/advisories/60696 - http
ttps://github.com/file/file/commit/69a5a43b3b71f53b0577f41264a073f495799610 - http://secunia.com/advisories/60696 - https://github.com/file/file/commit/758e066df72fb1ac08d2eea91ddc3973d259e991
CVE ID: CVE-2014-3539 State: PUBLISHED Published: 2018-04-06T16:00:00 Last Updated: 2024-08-06T10:50:17.644Z Vendors: n/a Products: n/a Problem Types: n/a Description: base/oi/doa.py in the Rope library in CPython (aka Python) allows remote attackers to execute arbitrary code by leveraging an unsafe call to pickle.load. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2015/02/07/1 - https://bugzilla.redhat.com/show_bug.cgi?id=1116485
CVE ID: CVE-2014-3540 State: REJECTED Published: 2014-07-08T01:00:00 Last Updated: 2014-07-08T00:57:00 Description: No description available.
CVE ID: CVE-2014-3541 State: PUBLISHED Published: 2014-07-29T10:00:00 Last Updated: 2024-08-06T10:50:16.890Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Repositories component in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via serialized data associated with an add-on. Additional Analyst Notes: - CVE Program Container: References: - https://moodle.org/mod/forum/discuss.php?d=264262 - http://openwall.com/lists/oss-security/2014/07/21/1 - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-45616
CVE ID: CVE-2014-3542 State: PUBLISHED Published: 2014-07-29T10:00:00 Last Updated: 2024-08-06T10:50:17.162Z Vendors: n/a Products: n/a Problem Types: n/a Description: mod/lti/service.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. Additional Analyst Notes: - CVE Program Container: References: - http://openwall.com/lists/oss-security/2014/07/21/1 - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-45463 - https://moodle.org/mod/forum/d
4/07/21/1 - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-45463 - https://moodle.org/mod/forum/discuss.php?d=264263
CVE ID: CVE-2014-3543 State: PUBLISHED Published: 2014-07-29T10:00:00 Last Updated: 2024-08-06T10:50:16.801Z Vendors: n/a Products: n/a Problem Types: n/a Description: mod/imscp/locallib.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to read arbitrary files via a package with a manifest file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue affecting IMSCP resources and the IMSCC format. Additional Analyst Notes: - CVE Program Container: References: - http://openwall.com/lists/oss-security/2014/07/21/1 - http://git.moodl
yst Notes: - CVE Program Container: References: - http://openwall.com/lists/oss-security/2014/07/21/1 - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-45417 - https://moodle.org/mod/forum/discuss.php?d=264264
CVE ID: CVE-2014-3544 State: PUBLISHED Published: 2014-07-29T10:00:00 Last Updated: 2024-08-06T10:50:16.819Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in user/profile.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote authenticated users to inject arbitrary web script or HTML via the Skype ID profile field. Additional Analyst Notes: - CVE Program Container: References: - http://openwall.com/lists/oss-security/2014/07/21/1 - http://osandamalith.wordpress.com/2014/07/25/moodle-2-7-persistent-xss/ - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit
th.wordpress.com/2014/07/25/moodle-2-7-persistent-xss/ - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-45683 - http://packetstormsecurity.com/files/127624/Moodle-2.7-Cross-Site-Scripting.html - http://www.exploit-db.com/exploits/34169 - http://osvdb.org/show/osvdb/109337 - http://www.securityfocus.com/bid/68756 - https://github.com/moodle/moodle/commit/ce5a785b0962c3c94c7a7b0d36176482d21db95d - https://moodle.org/mod/forum/discuss.php?d=264265
CVE ID: CVE-2014-3545 State: PUBLISHED Published: 2014-07-29T10:00:00 Last Updated: 2024-08-06T10:50:17.063Z Vendors: n/a Products: n/a Problem Types: n/a Description: Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote authenticated users to execute arbitrary code via a calculated question in a quiz. Additional Analyst Notes: - CVE Program Container: References: - https://moodle.org/mod/forum/discuss.php?d=264266 - http://openwall.com/lists/oss-security/2014/07/21/1 - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-46148
CVE ID: CVE-2014-3546 State: PUBLISHED Published: 2014-07-29T10:00:00 Last Updated: 2024-08-06T10:50:16.767Z Vendors: n/a Products: n/a Problem Types: n/a Description: Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 does not enforce certain capability requirements in (1) notes/index.php and (2) user/edit.php, which allows remote attackers to obtain potentially sensitive username and course information via a modified URL. Additional Analyst Notes: - CVE Program Container: References: - https://moodle.org/mod/forum/discuss.php?d=264267 - http://openwall.com/lists/oss-security/2014/07/21/1 - http://git.moodle.org/gw?p=moodle.git&a=searc
scuss.php?d=264267 - http://openwall.com/lists/oss-security/2014/07/21/1 - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-45760
CVE ID: CVE-2014-3547 State: PUBLISHED Published: 2014-07-29T10:00:00 Last Updated: 2024-08-06T10:50:16.890Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in badges/renderer.php in Moodle 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allow remote attackers to inject arbitrary web script or HTML via an external badge. Additional Analyst Notes: - CVE Program Container: References: - http://openwall.com/lists/oss-security/2014/07/21/1 - https://moodle.org/mod/forum/discuss.php?d=264269 - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-46042 - http://www.securityfocus.com/bid/68758
CVE ID: CVE-2014-3548 State: PUBLISHED Published: 2014-07-29T10:00:00 Last Updated: 2024-08-06T10:50:16.896Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allow remote attackers to inject arbitrary web script or HTML via vectors that trigger an AJAX exception dialog. Additional Analyst Notes: - CVE Program Container: References: - http://openwall.com/lists/oss-security/2014/07/21/1 - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-45471 - http://www.securityfocus.com/bid/68766 - https://moodle.org/
org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-45471 - http://www.securityfocus.com/bid/68766 - https://moodle.org/mod/forum/discuss.php?d=264270
CVE ID: CVE-2014-3549 State: PUBLISHED Published: 2014-07-29T10:00:00 Last Updated: 2024-08-06T10:50:16.607Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the get_description function in lib/classes/event/user_login_failed.php in Moodle 2.7.x before 2.7.1 allows remote attackers to inject arbitrary web script or HTML via a crafted username that is improperly handled during the logging of an invalid login attempt. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/68761 - http://openwall.com/lists/oss-security/2014/07/21/1 - https://moodle.org/mod/forum/discuss.php?d=264271 - http://git.moo
http://openwall.com/lists/oss-security/2014/07/21/1 - https://moodle.org/mod/forum/discuss.php?d=264271 - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-46201
CVE ID: CVE-2014-3550 State: PUBLISHED Published: 2014-07-29T10:00:00 Last Updated: 2024-08-06T10:50:16.338Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in admin/tool/task/scheduledtasks.php in Moodle 2.7.x before 2.7.1 allow remote attackers to inject arbitrary web script or HTML via vectors that trigger a crafted (1) error or (2) success message for a scheduled task. Additional Analyst Notes: - CVE Program Container: References: - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-46227 - http://openwall.com/lists/oss-security/2014/07/21/1 - http://www.securityfocus.com/bid/68762 - https://moodle.org/mod/
- http://openwall.com/lists/oss-security/2014/07/21/1 - http://www.securityfocus.com/bid/68762 - https://moodle.org/mod/forum/discuss.php?d=264272