Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2014-2936 State: PUBLISHED Published: 2014-05-08T10:00:00 Last Updated: 2024-08-06T10:28:46.333Z Vendors: n/a Products: n/a Problem Types: n/a Description: The directory manager in Caldera 9.20 allows remote attackers to conduct variable-injection attacks in the global scope via (1) the maindir_hotfolder parameter to dirmng/index.php, or an unspecified parameter to (2) PPD/index.php, (3) dirmng/docmd.php, or (4) dirmng/param.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/67254 - http://www.kb.cert.org/vuls/id/693092
CVE ID: CVE-2014-2937 State: REJECTED Published: 2014-11-06T00:00:00 Last Updated: 2014-11-05T23:57:01 Description: No description available.
CVE ID: CVE-2014-2938 State: PUBLISHED Published: 2014-05-22T20:00:00 Last Updated: 2024-08-06T10:28:46.249Z Vendors: n/a Products: n/a Problem Types: n/a Description: Hanvon FaceID before 1.007.110 does not require authentication, which allows remote attackers to modify access-control and attendance-tracking data via API commands. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/767044
CVE ID: CVE-2014-2939 State: PUBLISHED Published: 2014-06-02T19:00:00 Last Updated: 2024-08-06T10:28:46.176Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Alfresco Enterprise before 4.1.6.13 allow remote attackers to inject arbitrary web script or HTML via (1) an XHTML document, (2) a <% tag, or (3) the taskId parameter to share/page/task-edit. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/537684
CVE ID: CVE-2014-2940 State: PUBLISHED Published: 2014-08-15T10:00:00 Last Updated: 2024-08-06T10:28:46.139Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cobham Sailor 900 and 6000 satellite terminals with firmware 1.08 MFHF and 2.11 VHF have hardcoded credentials for the administrator account, which allows attackers to obtain administrative control by leveraging physical access or terminal access. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/460687
CVE ID: CVE-2014-2941 State: PUBLISHED Published: 2014-08-15T10:00:00 Last Updated: 2024-08-06T10:28:46.190Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cobham Sailor 6000 satellite terminals have hardcoded Tbus 2 credentials, which allows remote attackers to obtain access via a TBUS2 command. NOTE: the vendor reportedly states "there is no possibility to exploit another user's credentials. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/269991
CVE ID: CVE-2014-2942 State: PUBLISHED Published: 2014-09-22T10:00:00 Last Updated: 2024-08-06T10:28:46.317Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cobham Aviator 700D and 700E satellite terminals use an improper algorithm for PIN codes, which makes it easier for attackers to obtain a privileged terminal session by calculating the superuser code, and then leveraging physical access or terminal access to enter this code. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/882207
CVE ID: CVE-2014-2943 State: REJECTED Published: 2014-08-15T10:00:00 Last Updated: 2014-09-22T08:57:01 Description: No description available.
CVE ID: CVE-2014-2944 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2014-2945 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2014-2946 State: PUBLISHED Published: 2014-06-02T19:00:00 Last Updated: 2024-08-06T10:28:46.160Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in api/sms/send-sms in the Web UI 11.010.06.01.858 on Huawei E303 modems with software 22.157.18.00.858 allows remote attackers to hijack the authentication of administrators for requests that perform API operations and send SMS messages via a request element in an XML document. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/325636 - http://b.fl7.de/2014/05/huawei-e303-sms-vulnerability-CVE-2014-2946.html - http://secunia.com/advis
org/vuls/id/325636 - http://b.fl7.de/2014/05/huawei-e303-sms-vulnerability-CVE-2014-2946.html - http://secunia.com/advisories/58992
CVE ID: CVE-2014-2947 State: PUBLISHED Published: 2014-05-22T20:00:00 Last Updated: 2024-08-06T10:28:46.358Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Login.aspx in Bizagi BPM Suite before 10.3 allows remote attackers to inject arbitrary web script or HTML via the txtUsername parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/112412 - http://www.securityfocus.com/bid/67591
CVE ID: CVE-2014-2948 State: PUBLISHED Published: 2014-05-22T20:00:00 Last Updated: 2024-08-06T10:28:46.155Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in workflowenginesoa.asmx in Bizagi BPM Suite through 10.4 allows remote authenticated users to execute arbitrary SQL commands via a crafted SOAP request. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/112412
CVE ID: CVE-2014-2949 State: PUBLISHED Published: 2014-06-18T16:00:00 Last Updated: 2024-08-06T10:28:46.063Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the web service in F5 ARX Data Manager 3.0.0 through 3.1.0 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://support.f5.com/kb/en-us/solutions/public/15000/300/sol15310.html?sr=38021626 - http://www.zerodayinitiative.com/advisories/ZDI-14-293/ - http://www.securityfocus.com/bid/68078 - http://www.kb.cert.org/vuls/id/210884
CVE ID: CVE-2014-2950 State: PUBLISHED Published: 2014-07-14T21:00:00 Last Updated: 2024-08-06T10:28:46.118Z Vendors: n/a Products: n/a Problem Types: n/a Description: Datum Systems SnIP on PSM-500 and PSM-4500 devices does not require authentication for FTP sessions, which allows remote attackers to obtain sensitive information via RETR commands. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/917348
CVE ID: CVE-2014-2951 State: PUBLISHED Published: 2014-07-14T21:00:00 Last Updated: 2024-08-06T10:28:46.331Z Vendors: n/a Products: n/a Problem Types: n/a Description: Datum Systems SnIP on PSM-500 and PSM-4500 devices has a hardcoded password of admin for the admin account, which makes it easier for remote attackers to obtain access via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/917348
CVE ID: CVE-2014-2955 State: PUBLISHED Published: 2014-07-14T21:00:00 Last Updated: 2024-08-06T10:28:46.298Z Vendors: n/a Products: n/a Problem Types: n/a Description: Raritan PX before 1.5.11 on DPXR20A-16 devices allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using cipher suite 0 (aka cipher zero) and an arbitrary password. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2014/Jul/14 - http://www.kb.cert.org/vuls/id/712660
CVE ID: CVE-2014-2956 State: PUBLISHED Published: 2014-07-08T10:00:00 Last Updated: 2024-08-06T10:28:45.999Z Vendors: n/a Products: n/a Problem Types: n/a Description: ScriptHelperApi in the AVG ScriptHelper ActiveX control in ScriptHelper.exe in AVG Secure Search toolbar before 18.1.7.598 and AVG Safeguard before 18.1.7.644 does not implement domain-based access control for method calls, which allows remote attackers to trigger the downloading and execution of arbitrary programs via a crafted web site. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/960193
CVE ID: CVE-2014-2957 State: PUBLISHED Published: 2014-09-04T17:00:00 Last Updated: 2024-08-06T10:28:46.230Z Vendors: n/a Products: n/a Problem Types: n/a Description: The dmarc_process function in dmarc.c in Exim before 4.82.1, when EXPERIMENTAL_DMARC is enabled, allows remote attackers to execute arbitrary code via the From header in an email, which is passed to the expand_string function. Additional Analyst Notes: - CVE Program Container: References: - https://lists.exim.org/lurker/message/20140528.122536.a31d60a4.en.html - http://git.exim.org/exim.git/commitdiff/5b7a7c051c9ab9ee7c924a611f90ef2be03e0ad0 - http://www.openwall.com/lists/oss-security/2021/05/04/7
CVE ID: CVE-2014-2959 State: PUBLISHED Published: 2014-06-02T19:00:00 Last Updated: 2024-08-06T10:28:46.358Z Vendors: n/a Products: n/a Problem Types: n/a Description: logViewer.htm on the Dell ML6000 tape backup system with firmware before i8.2.0.2 (641G.GS103) and the Quantum Scalar i500 tape backup system with firmware before i8.2.2.1 (646G.GS002) allows remote attackers to execute arbitrary commands via shell metacharacters in a pathname parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/67751 - http://www.kb.cert.org/vuls/id/124908 - http://secunia.com/advisories/59019
CVE ID: CVE-2014-2960 State: PUBLISHED Published: 2017-04-10T03:00:00 Last Updated: 2024-08-06T10:28:46.216Z Vendors: n/a Products: Vision Critical before 2014-05-30 Problem Types: read arbitrary files Description: Vision Critical before 2014-05-30 allows attackers to read arbitrary files via unspecified vectors, as demonstrated by image files and configuration files. Additional Analyst Notes: - CVE Program Container: References: - https://www.visioncritical.com/customer-advisory-vision-critical-cto/
CVE ID: CVE-2014-2962 State: PUBLISHED Published: 2014-06-19T10:00:00 Last Updated: 2024-08-06T10:28:46.378Z Vendors: n/a Products: n/a Problem Types: n/a Description: Absolute path traversal vulnerability in the webproc cgi module on the Belkin N150 F9K1009 v1 router with firmware before 1.00.08 allows remote attackers to read arbitrary files via a full pathname in the getpage parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/38488/ - http://www.kb.cert.org/vuls/id/774788 - http://www.belkin.com/us/support-article?articleNum=109400
CVE ID: CVE-2014-2963 State: PUBLISHED Published: 2014-07-10T10:00:00 Last Updated: 2024-08-06T10:28:46.333Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in group/control_panel/manage in Liferay Portal 6.1.2 CE GA3, 6.1.X EE, and 6.2.X EE allow remote attackers to inject arbitrary web script or HTML via the (1) _2_firstName, (2) _2_lastName, or (3) _2_middleName parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/100972 - https://github.com/samuelkong/liferay-portal/pull/610
CVE ID: CVE-2014-2964 State: PUBLISHED Published: 2014-08-15T10:00:00 Last Updated: 2024-08-06T10:28:46.049Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cobham Aviator 700D and 700E satellite terminals have hardcoded passwords for the (1) debug, (2) prod, (3) do160, and (4) flrp programs, which allows physically proximate attackers to gain privileges by sending a password over a serial line. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/882207
CVE ID: CVE-2014-2965 State: PUBLISHED Published: 2014-07-03T14:00:00 Last Updated: 2024-08-06T10:28:46.242Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in auth-settings-x.php in SpamTitan before 6.04 allows remote attackers to inject arbitrary web script or HTML via the sortdir parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/68143 - http://www.kb.cert.org/vuls/id/849500 - http://seclists.org/fulldisclosure/2014/Jun/113 - http://packetstormsecurity.com/files/127184/SpamTitan-6.01-Cross-Site-Scripting.html
CVE ID: CVE-2014-2966 State: PUBLISHED Published: 2014-07-26T15:00:00 Last Updated: 2024-08-06T10:28:46.194Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ISO-8859-1 encoder in Resin Pro before 4.0.40 does not properly perform Unicode transformations, which allows remote attackers to bypass intended text restrictions via crafted characters, as demonstrated by bypassing an XSS protection mechanism. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/162308 - http://caucho.com/products/resin/download#download
CVE ID: CVE-2014-2967 State: PUBLISHED Published: 2014-07-07T10:00:00 Last Updated: 2024-08-06T10:28:46.348Z Vendors: n/a Products: n/a Problem Types: n/a Description: Autodesk VRED Professional 2014 before SR1 SP8 allows remote attackers to execute arbitrary code via Python os library calls in Python API commands to the integrated web server. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/402020
CVE ID: CVE-2014-2968 State: PUBLISHED Published: 2014-07-24T14:00:00 Last Updated: 2024-08-06T10:28:46.179Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the web interface on the Huawei E355 CH1E355SM modem with software 21.157.37.01.910 and Web UI 11.001.08.00.03 allows remote attackers to inject arbitrary web script or HTML via an SMS message. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/688812
CVE ID: CVE-2014-2969 State: PUBLISHED Published: 2014-07-07T10:00:00 Last Updated: 2024-08-06T10:28:46.349Z Vendors: n/a Products: n/a Problem Types: n/a Description: NETGEAR GS108PE Prosafe Plus switches with firmware 1.2.0.5 have a hardcoded password of debugpassword for the ntgruser account, which allows remote attackers to upload firmware or read or modify memory contents, and consequently execute arbitrary code, via a request to (1) produce_burn.cgi, (2) register_debug.cgi, or (3) bootcode_update.cgi. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/143740
CVE ID: CVE-2014-2970 State: REJECTED Published: 2014-07-31T01:00:00 Last Updated: 2014-07-31T01:57:01 Description: No description available.
CVE ID: CVE-2014-2971 State: PUBLISHED Published: 2014-07-24T14:00:00 Last Updated: 2024-08-06T10:28:46.347Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in AddStdLetter.jsp in MicroPact iComplaints before 8.0.2.1.8.8014 allows remote authenticated users to inject arbitrary web script or HTML via the description parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/875548
CVE ID: CVE-2014-2972 State: PUBLISHED Published: 2014-09-04T17:00:00 Last Updated: 2024-08-06T10:28:46.371Z Vendors: n/a Products: n/a Problem Types: n/a Description: expand.c in Exim before 4.83 expands mathematical comparisons twice, which allows local users to gain privileges and execute arbitrary commands via a crafted lookup value. Additional Analyst Notes: - CVE Program Container: References: - http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136264.html - http://git.exim.org/exim.git/commitdiff/7685ce68148a083d7759e78d01aa5198fc099c44 - http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136251.html - https://lists.exim.org/lurker/message/201407
ists.fedoraproject.org/pipermail/package-announce/2014-August/136251.html - https://lists.exim.org/lurker/message/20140722.145949.42c043f5.en.html - https://lists.exim.org/lurker/message/20140722.152452.d6c019e8.en.html - https://security.gentoo.org/glsa/201607-12 - http://www.ubuntu.com/usn/USN-2933-1 - https://bugzilla.redhat.com/show_bug.cgi?id=1122552
CVE ID: CVE-2014-2973 State: REJECTED Published: 2014-12-15T17:27:00 Last Updated: 2014-12-15T04:57:00 Description: No description available.
CVE ID: CVE-2014-2974 State: PUBLISHED Published: 2014-07-28T17:00:00 Last Updated: 2024-08-06T10:28:46.281Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in php/user_account.php in Silver Peak VX through 6.2.4 allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/867980
CVE ID: CVE-2014-2975 State: PUBLISHED Published: 2014-07-28T17:00:00 Last Updated: 2024-08-06T10:28:46.331Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in php/user_account.php in Silver Peak VX before 6.2.4 allows remote attackers to inject arbitrary web script or HTML via the user_id parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/867980 - http://www.securityfocus.com/bid/68923
CVE ID: CVE-2014-2976 State: PUBLISHED Published: 2014-04-23T14:00:00 Last Updated: 2024-08-06T10:28:46.335Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in Sixnet SixView Manager 2.4.1 allows remote attackers to read arbitrary files via a .. (dot dot) in an HTTP GET request to TCP port 18081. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/32973 - http://secunia.com/advisories/58231
CVE ID: CVE-2014-2977 State: PUBLISHED Published: 2014-06-11T14:00:00 Last Updated: 2024-08-06T10:28:46.245Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple integer signedness errors in the Dispatch_Write function in proxy/dispatcher/idirectfbsurface_dispatcher.c in DirectFB 1.4.13 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the Voodoo interface, which triggers a stack-based buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2014/05/15/9 - http://www.mandriva.com/security/advisories?name=MDVSA-2015:223 - http://lists.opensuse.org/opensuse-secur
014/05/15/9 - http://www.mandriva.com/security/advisories?name=MDVSA-2015:223 - http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00003.html - https://security.gentoo.org/glsa/201701-55 - http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00019.html - http://mail.directfb.org/pipermail/directfb-dev/2014-March/006805.html - http://advisories.mageia.org/MGASA-2015-0176.html - http://secunia.com/advisories/58448
CVE ID: CVE-2014-2978 State: PUBLISHED Published: 2014-06-11T14:00:00 Last Updated: 2024-08-06T10:28:46.419Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Dispatch_Write function in proxy/dispatcher/idirectfbsurface_dispatcher.c in DirectFB 1.4.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the Voodoo interface, which triggers an out-of-bounds write. Additional Analyst Notes: - CVE Program Container: References: - http://www.mandriva.com/security/advisories?name=MDVSA-2015:223 - http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00003.html - https://security.gentoo.org/glsa/201701-55 - http://lists.opensuse
rg/opensuse-security-announce/2015-05/msg00003.html - https://security.gentoo.org/glsa/201701-55 - http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00019.html - http://mail.directfb.org/pipermail/directfb-dev/2014-March/006805.html - http://advisories.mageia.org/MGASA-2015-0176.html - http://www.openwall.com/lists/oss-security/2014/05/15/10 - http://secunia.com/advisories/58448
CVE ID: CVE-2014-2980 State: PUBLISHED Published: 2014-04-28T14:00:00 Last Updated: 2024-08-06T10:28:46.382Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tools/gdomap.c in gdomap in GNUstep Base 1.24.6 and earlier, when run in daemon mode, does not properly handle the file descriptor for the logger, which allows remote attackers to cause a denial of service (abort) via an invalid request. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/92688 - https://savannah.gnu.org/bugs/?41751 - http://svn.gna.org/viewcvs/gnustep/libs/base/trunk/Tools/gdomap.c?r1=37756&r2=37755&pathrev=37756 - http://www.securityfocus.com/
n.gna.org/viewcvs/gnustep/libs/base/trunk/Tools/gdomap.c?r1=37756&r2=37755&pathrev=37756 - http://www.securityfocus.com/bid/66992 - http://svn.gna.org/viewcvs/gnustep/libs/base/trunk/ChangeLog?r1=37756&r2=37755&pathrev=37756 - http://seclists.org/oss-sec/2014/q2/152 - http://seclists.org/oss-sec/2014/q2/143 - http://secunia.com/advisories/58104
CVE ID: CVE-2014-2983 State: PUBLISHED Published: 2014-04-23T14:00:00 Last Updated: 2024-08-06T10:28:46.382Z Vendors: n/a Products: n/a Problem Types: n/a Description: Drupal 6.x before 6.31 and 7.x before 7.27 does not properly isolate the cached data of different anonymous users, which allows remote anonymous users to obtain sensitive interim form input information in opportunistic situations via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2014/dsa-2913 - https://drupal.org/SA-CORE-2014-002 - http://www.debian.org/security/2014/dsa-2914 - http://www.openwall.com/lists/oss-security/2014/04/22/2
CVE ID: CVE-2014-2984 State: REJECTED Published: 2014-04-25T01:00:00 Last Updated: 2014-04-25T01:57:01 Description: No description available.
CVE ID: CVE-2014-2986 State: PUBLISHED Published: 2014-04-28T14:00:00 Last Updated: 2024-08-06T10:28:46.369Z Vendors: n/a Products: n/a Problem Types: n/a Description: The vgic_distr_mmio_write function in the virtual guest interrupt controller (GIC) distributor (arch/arm/vgic.c) in Xen 4.4.x, when running on an ARM system, allows local guest users to cause a denial of service (NULL pointer dereference and host crash) via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1030146 - http://www.openwall.com/lists/oss-security/2014/04/23/3 - http://www.openwall.com/lists/oss-security/2014/04/23/5 - http://xenbits.xen.org/xsa/a
lists/oss-security/2014/04/23/3 - http://www.openwall.com/lists/oss-security/2014/04/23/5 - http://xenbits.xen.org/xsa/advisory-94.html - http://www.securityfocus.com/bid/67047 - http://www.openwall.com/lists/oss-security/2014/04/23/4
CVE ID: CVE-2014-2987 State: PUBLISHED Published: 2014-10-26T18:00:00 Last Updated: 2024-08-06T10:28:46.351Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in EGroupware Enterprise Line (EPL) before 1.1.20140505, EGroupware Community Edition before 1.8.007.20140506, and EGroupware before 14.1 beta allow remote attackers to hijack the authentication of administrators for requests that (1) create an administrator user via an admin.uiaccounts.add_user action to index.php or (2) modify settings via the newsettings parameter in an admin.uiconfig.index action to index.php. NOTE: vector 2 can be used to execute arbitrary PHP cod
ttings parameter in an admin.uiconfig.index action to index.php. NOTE: vector 2 can be used to execute arbitrary PHP code by leveraging CVE-2014-2988. Additional Analyst Notes: - CVE Program Container: References: - http://advisories.mageia.org/MGASA-2014-0221.html - http://www.mandriva.com/security/advisories?name=MDVSA-2015:087 - http://secunia.com/advisories/58346 - http://www.egroupware.org/forum#nabble-td3997580 - https://www.htbridge.com/advisory/HTB23212 - http://www.egroupware.org/changelog - http://www.securityfocus.com/archive/1/532103/100/0/threaded