Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2014-2288 State: PUBLISHED Published: 2014-04-18T19:00:00 Last Updated: 2024-08-06T10:06:00.194Z Vendors: n/a Products: n/a Problem Types: n/a Description: The PJSIP channel driver in Asterisk Open Source 12.x before 12.1.1, when qualify_frequency "is enabled on an AOR and the remote SIP server challenges for authentication of the resulting OPTIONS request," allows remote attackers to cause a denial of service (crash) via a PJSIP endpoint that does not have an associated outgoing request. Additional Analyst Notes: - CVE Program Container: References: - http://downloads.asterisk.org/pub/security/AST-2014-003-12.diff - http://downloads.asterisk.org/pub/security/AST-2014-003.html -
wnloads.asterisk.org/pub/security/AST-2014-003-12.diff - http://downloads.asterisk.org/pub/security/AST-2014-003.html - https://issues.asterisk.org/jira/browse/ASTERISK-23210 - http://lists.fedoraproject.org/pipermail/package-announce/2014-March/130426.html - http://lists.fedoraproject.org/pipermail/package-announce/2014-March/130400.html
CVE ID: CVE-2014-2289 State: PUBLISHED Published: 2014-04-18T19:00:00 Last Updated: 2024-08-06T10:06:00.290Z Vendors: n/a Products: n/a Problem Types: n/a Description: res/res_pjsip_exten_state.c in the PJSIP channel driver in Asterisk Open Source 12.x before 12.1.0 allows remote authenticated users to cause a denial of service (crash) via a SUBSCRIBE request without any Accept headers, which triggers an invalid pointer dereference. Additional Analyst Notes: - CVE Program Container: References: - https://issues.asterisk.org/jira/browse/ASTERISK-23139 - http://downloads.asterisk.org/pub/security/AST-2014-004-12.diff - http://downloads.asterisk.org/pub/security/AST-2014-004.html - http://lists
risk.org/pub/security/AST-2014-004-12.diff - http://downloads.asterisk.org/pub/security/AST-2014-004.html - http://lists.fedoraproject.org/pipermail/package-announce/2014-March/130426.html - http://lists.fedoraproject.org/pipermail/package-announce/2014-March/130400.html
CVE ID: CVE-2014-2291 State: PUBLISHED Published: 2014-03-14T15:00:00 Last Updated: 2024-08-06T10:06:00.220Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Pulse Collaboration (Secure Meeting) user pages in Juniper Junos Pulse Secure Access Service (aka SSL VPN) with IVE OS before 7.1r18, 7.3 before 7.3r10, 7.4 before 7.4r8, and 8.0 before 8.0r1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/91770 - https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10617 - h
xchange.xforce.ibmcloud.com/vulnerabilities/91770 - https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10617 - http://secunia.com/advisories/57375
CVE ID: CVE-2014-2292 State: PUBLISHED Published: 2014-03-14T15:00:00 Last Updated: 2024-08-06T10:06:00.340Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in the Linux Network Connect client in Juniper Junos Pulse Secure Access Service (aka SSL VPN) with IVE OS before 7.1r18, 7.3 before 7.3r10, 7.4 before 7.4r8, and 8.0 before 8.0r1 allows local users to gain privileges via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10616
CVE ID: CVE-2014-2293 State: PUBLISHED Published: 2018-03-26T18:00:00 Last Updated: 2024-08-06T10:06:00.304Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zikula Application Framework before 1.3.7 build 11 allows remote attackers to conduct PHP object injection attacks and delete arbitrary files or execute arbitrary PHP code via crafted serialized data in the (1) authentication_method_ser or (2) authentication_info_ser parameter to index.php, or (3) zikulaMobileTheme parameter to index.php. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/91787 - https://secuniaresearch.flexerasoftware.com/secunia_research/2014
//exchange.xforce.ibmcloud.com/vulnerabilities/91787 - https://secuniaresearch.flexerasoftware.com/secunia_research/2014-2/ - https://exchange.xforce.ibmcloud.com/vulnerabilities/91786 - http://karmainsecurity.com/KIS-2014-02
CVE ID: CVE-2014-2294 State: PUBLISHED Published: 2018-04-17T19:00:00 Last Updated: 2024-08-06T10:06:00.285Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open Web Analytics (OWA) before 1.5.7 allows remote attackers to conduct PHP object injection attacks via a crafted serialized object in the owa_event parameter to queue.php. Additional Analyst Notes: - CVE Program Container: References: - https://secuniaresearch.flexerasoftware.com/advisories/56999 - http://www.openwebanalytics.com/?p=388 - https://secuniaresearch.flexerasoftware.com/secunia_research/2014-3/ - http://karmainsecurity.com/KIS-2014-03 - https://www.securityfocus.com/bid/66076
CVE ID: CVE-2014-2296 State: PUBLISHED Published: 2018-07-20T17:00:00 Last Updated: 2024-08-06T10:06:00.271Z Vendors: n/a Products: n/a Problem Types: n/a Description: XML external entity (XXE) vulnerability in java/org/jasig/cas/util/SamlUtils.java in Jasig CAS server before 3.4.12.1 and 3.5.x before 3.5.2.1, when Google Accounts Integration is enabled, allows remote unauthenticated users to bypass authentication via crafted XML data. Additional Analyst Notes: - CVE Program Container: References: - http://jasig.275507.n4.nabble.com/CAS-3-5-2-1-and-3-4-12-1-Security-Releases-td4662444.html - https://vigilance.fr/vulnerability/Jasig-CAS-Server-bypassing-authentication-via-Google-Accounts-Inte
s-td4662444.html - https://vigilance.fr/vulnerability/Jasig-CAS-Server-bypassing-authentication-via-Google-Accounts-Integration-14512
CVE ID: CVE-2014-2297 State: PUBLISHED Published: 2018-03-19T21:00:00 Last Updated: 2024-08-06T10:06:00.325Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin 4.29.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) n parameter to ls/htmlchat.php or (2) bgcolor parameter to ls/index.php. NOTE: vector 1 may overlap CVE-2014-1906.4. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/531773/100/0/threaded
CVE ID: CVE-2014-2299 State: PUBLISHED Published: 2014-03-11T01:00:00 Last Updated: 2024-08-06T10:06:00.278Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the mpeg_read function in wiretap/mpeg.c in the MPEG parser in Wireshark 1.8.x before 1.8.13 and 1.10.x before 1.10.6 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a large record in MPEG data. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/126337/Wireshark-1.8.12-1.10.5-wiretap-mpeg.c-Stack-Buffer-Overflow.html - http://osvdb.org/show/osvdb/104199 - http://secunia.com/advisories/57489 - http://rhn.
eg.c-Stack-Buffer-Overflow.html - http://osvdb.org/show/osvdb/104199 - http://secunia.com/advisories/57489 - http://rhn.redhat.com/errata/RHSA-2014-0341.html - http://secunia.com/advisories/57480 - http://www.wireshark.org/security/wnpa-sec-2014-04.html - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9843 - http://www.exploit-db.com/exploits/33069 - http://lists.opensuse.org/opensuse-updates/2014-03/msg00046.html - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=f567435ac7140c96a5de56dbce3d5e7659af4d09 - http://www.securitytracker.com/id/1029907 - http://lists.opensuse.org/opensuse-updates/2014-03/msg00047.html - http://www.debian.org/security/2014/dsa-2871 - ht
7 - http://lists.opensuse.org/opensuse-updates/2014-03/msg00047.html - http://www.debian.org/security/2014/dsa-2871 - http://rhn.redhat.com/errata/RHSA-2014-0342.html - http://www.securityfocus.com/bid/66066
CVE ID: CVE-2014-2301 State: PUBLISHED Published: 2014-05-12T14:00:00 Last Updated: 2024-08-06T10:06:00.290Z Vendors: n/a Products: n/a Problem Types: n/a Description: OrbiTeam BSCW before 5.0.8 allows remote attackers to obtain sensitive metadata via the inf operations (op=inf) to an object in pub/bscw.cgi/. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/532055/100/0/threaded - https://www.redteam-pentesting.de/en/advisories/rt-sa-2014-003/-metadata-information-disclosure-in-orbiteam-bscw - http://www.bscw.de/english/news.html
CVE ID: CVE-2014-2302 State: PUBLISHED Published: 2018-07-19T17:00:00 Last Updated: 2024-08-06T10:06:00.206Z Vendors: n/a Products: n/a Problem Types: n/a Description: The installer script in webEdition CMS before 6.2.7-s1 and 6.3.x before 6.3.8-s1 allows remote attackers to conduct PHP Object Injection attacks by intercepting a request to update.webedition.org. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2014/May/147 - http://packetstormsecurity.com/files/126861/webEdition-CMS-2.8.0.0-Remote-Command-Execution.html - http://www.securityfocus.com/bid/67692 - https://www.redteam-pentesting.de/advisories/rt-sa-2014-004 - http://www.securit
ttp://www.securityfocus.com/bid/67692 - https://www.redteam-pentesting.de/advisories/rt-sa-2014-004 - http://www.securityfocus.com/archive/1/532230/100/0/threaded
CVE ID: CVE-2014-2303 State: PUBLISHED Published: 2014-06-13T14:00:00 Last Updated: 2024-08-06T10:06:00.290Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in the file browser component (we_fs.php) in webEdition CMS before 6.2.7-s1.2 and 6.3.x through 6.3.8 before -s1 allow remote attackers to execute arbitrary SQL commands via the (1) table or (2) order parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/532231/100/0/threaded - http://packetstormsecurity.com/files/126862/webEdition-CMS-6.3.8.0-svn6985-SQL-Injection.html - http://seclists.org/fulldisclosure/2014/May/148 - https:/
les/126862/webEdition-CMS-6.3.8.0-svn6985-SQL-Injection.html - http://seclists.org/fulldisclosure/2014/May/148 - https://www.redteam-pentesting.de/en/advisories/rt-sa-2014-005/-sql-injection-in-webedition-cms-file-browser - http://www.securityfocus.com/bid/67689 - http://www.webedition.org/de/aktuelles/allgemein/Wichtiges-Sicherheitsupdate-fuer-CMS-webEdition-veroeffentlicht
CVE ID: CVE-2014-2304 State: PUBLISHED Published: 2019-10-23T17:01:41 Last Updated: 2024-08-06T10:06:00.338Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in version 0.90 of the Open Floodlight SDN controller software could result in a denial of service attack and crashing of the controller service. This effect is the result of a flaw in OpenFlow protocol processing, where specific malformed and mistimed FEATURES_REPLY messages cause the controller service to not delete switch and port data from its internal tracking structures. Additional Analyst Notes: - CVE Program Container: References: - http://dovernetworks.com/wp-content/uploads/2014/03/OpenFloodlight-0305
st Notes: - CVE Program Container: References: - http://dovernetworks.com/wp-content/uploads/2014/03/OpenFloodlight-03052014.pdf
CVE ID: CVE-2014-2309 State: PUBLISHED Published: 2014-03-11T01:00:00 Last Updated: 2024-08-06T10:06:00.287Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ip6_route_add function in net/ipv6/route.c in the Linux kernel through 3.13.6 does not properly count the addition of routes, which allows remote attackers to cause a denial of service (memory consumption) via a flood of ICMPv6 Router Advertisement packets. Additional Analyst Notes: - CVE Program Container: References: - http://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=c88507fbad8055297c1d1e21e599f46960cbee39 - http://www.openwall.com/lists/oss-security/2014/03/08/1 - http://lists.opensuse.org/opensuse-
7c1d1e21e599f46960cbee39 - http://www.openwall.com/lists/oss-security/2014/03/08/1 - http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.html - http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.html - http://www.securityfocus.com/bid/66095 - http://secunia.com/advisories/57250 - http://www.securitytracker.com/id/1029894
CVE ID: CVE-2014-2310 State: PUBLISHED Published: 2014-04-17T14:00:00 Last Updated: 2024-08-06T10:06:00.237Z Vendors: n/a Products: n/a Problem Types: n/a Description: The AgentX subagent in Net-SNMP before 5.4.4 allows remote attackers to cause a denial of service (hang) by sending a multi-object request with an Object ID (OID) containing more subids than previous requests, a different vulnerability than CVE-2012-6151. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/57870 - http://sourceforge.net/p/net-snmp/patches/1113/ - http://seclists.org/oss-sec/2014/q1/513 - http://sourceforge.net/p/net-snmp/code/ci/eb816330a1887798d844d2fd5dc6482002123cb
p://seclists.org/oss-sec/2014/q1/513 - http://sourceforge.net/p/net-snmp/code/ci/eb816330a1887798d844d2fd5dc6482002123cbd/ - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=684388 - http://seclists.org/oss-sec/2014/q1/527 - http://ubuntu.com/usn/usn-2166-1
CVE ID: CVE-2014-2311 State: PUBLISHED Published: 2014-03-11T15:00:00 Last Updated: 2024-08-06T10:06:00.233Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in modx.class.php in MODX Revolution 2.0.0 before 2.2.13 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2014/03/09/3 - http://forums.modx.com/thread/89486/modx-revolution-2-x-sql-injection - http://modx.com/blog/2014/03/07/revolution-2.2.13/
CVE ID: CVE-2014-2312 State: PUBLISHED Published: 2018-03-26T18:00:00 Last Updated: 2024-08-06T10:06:00.465Z Vendors: n/a Products: n/a Problem Types: n/a Description: The main function in android_main.cpp in thermald allows local users to write to arbitrary files via a symlink attack on /tmp/thermald.pid. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2014/03/09/2 - http://www.openwall.com/lists/oss-security/2014/03/08/4
CVE ID: CVE-2014-2313 State: PUBLISHED Published: 2014-03-07T20:00:00Z Last Updated: 2024-09-16T22:46:10.244Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the Importers plugin in Atlassian JIRA before 6.0.5 allows remote attackers to create arbitrary files via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2014-02-26
CVE ID: CVE-2014-2314 State: PUBLISHED Published: 2014-03-07T20:00:00 Last Updated: 2024-08-06T10:06:00.445Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the Issue Collector plugin in Atlassian JIRA before 6.0.4 allows remote attackers to create arbitrary files via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2014-02-26 - http://www.exploit-db.com/exploits/32725 - http://blog.h3xstream.com/2014/02/jira-path-traversal-explained.html
CVE ID: CVE-2014-2315 State: PUBLISHED Published: 2014-03-07T20:00:00 Last Updated: 2024-08-06T10:06:00.388Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the Thank You Counter Button plugin 1.8.7 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) thanks_caption, (2) thanks_caption_style, or (3) thanks_style parameter to wp-admin/options.php. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/91474 - http://www.securityfocus.com/bid/65805 - http://packetstormsecurity.com/files/125397
CVE ID: CVE-2014-2316 State: PUBLISHED Published: 2014-03-07T20:00:00 Last Updated: 2024-08-06T10:06:00.380Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in se_search_default in the Search Everything plugin before 7.0.3 for WordPress allows remote attackers to execute arbitrary SQL commands via the s parameter to index.php. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/65765 - http://secunia.com/advisories/56820 - http://wordpress.org/plugins/search-everything/changelog/
CVE ID: CVE-2014-2317 State: PUBLISHED Published: 2014-03-07T20:00:00Z Last Updated: 2024-09-17T00:06:30.711Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in ajax_udf.php in OpenDocMan before 1.2.7.2 allows remote attackers to execute arbitrary SQL commands via the table parameter. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/65775 - http://secunia.com/advisories/56189 - http://www.opendocman.com/opendocman-v1-2-7-2-released
CVE ID: CVE-2014-2318 State: PUBLISHED Published: 2014-03-10T14:00:00 Last Updated: 2024-08-06T10:06:00.422Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in ATCOM Netvolution 3 allows remote attackers to execute arbitrary SQL commands via the m parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/91543 - http://www.securityfocus.com/bid/65942 - http://packetstormsecurity.com/files/125507
CVE ID: CVE-2014-2319 State: PUBLISHED Published: 2014-03-14T10:00:00 Last Updated: 2024-08-06T10:06:00.418Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Encrypt Files feature in ConeXware PowerArchiver before 14.02.05 uses legacy ZIP encryption even if the AES 256-bit selection is chosen, which makes it easier for context-dependent attackers to obtain sensitive information via a known-plaintext attack. Additional Analyst Notes: - CVE Program Container: References: - http://int21.de/cve/CVE-2014-2319-powerarchiver.html - http://www.powerarchiver.com/2014/03/12/powerarchiver-2013-14-02-05-released/
CVE ID: CVE-2014-2321 State: PUBLISHED Published: 2014-03-11T10:00:00Z Last Updated: 2024-09-16T19:57:35.455Z Vendors: n/a Products: n/a Problem Types: n/a Description: web_shell_cmd.gch on ZTE F460 and F660 cable modems allows remote attackers to obtain administrative access via sendcmd requests, as demonstrated by using "set TelnetCfg" commands to enable a TELNET service with specified credentials. Additional Analyst Notes: - CVE Program Container: References: - http://www.myxzy.com/post-411.html - https://community.rapid7.com/community/infosec/blog/2014/03/03/disclosure-r7-2013-18-zte-f460-and-zte-f660-webshellcmdgch-backdoor - http://www.kb.cert.org/vuls/id/600724
CVE ID: CVE-2014-2322 State: PUBLISHED Published: 2014-05-02T14:00:00 Last Updated: 2024-08-06T10:06:00.480Z Vendors: n/a Products: n/a Problem Types: n/a Description: lib/string_utf_support.rb in the Arabic Prawn 0.0.1 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) downloaded_file or (2) url variable. Additional Analyst Notes: - CVE Program Container: References: - http://www.vapid.dhs.org/advisories/arabic-ruby-gem.html - http://www.openwall.com/lists/oss-security/2014/03/10/8 - http://www.openwall.com/lists/oss-security/2014/03/12/6
CVE ID: CVE-2014-2323 State: PUBLISHED Published: 2014-03-14T15:00:00 Last Updated: 2024-08-06T10:06:00.483Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name, related to request_check_hostname. Additional Analyst Notes: - CVE Program Container: References: - http://www.lighttpd.net/2014/3/12/1.4.35/ - http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2014_01.txt - http://www.debian.org/security/2014/dsa-2877 - http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00023.html - http://secunia.com/advisories/57514 - h
7 - http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00023.html - http://secunia.com/advisories/57514 - http://marc.info/?l=bugtraq&m=141576815022399&w=2 - http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00006.html - http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00002.html - http://secunia.com/advisories/57404 - http://seclists.org/oss-sec/2014/q1/564 - http://seclists.org/oss-sec/2014/q1/561 - http://jvn.jp/en/jp/JVN37417423/index.html
CVE ID: CVE-2014-2324 State: PUBLISHED Published: 2014-03-14T15:00:00 Last Updated: 2024-08-06T10:06:00.322Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple directory traversal vulnerabilities in (1) mod_evhost and (2) mod_simple_vhost in lighttpd before 1.4.35 allow remote attackers to read arbitrary files via a .. (dot dot) in the host name, related to request_check_hostname. Additional Analyst Notes: - CVE Program Container: References: - http://www.lighttpd.net/2014/3/12/1.4.35/ - http://www.securityfocus.com/bid/66157 - http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2014_01.txt - http://www.debian.org/security/2014/dsa-2877 - http://lists.opensuse.org/ope
lighttpd/security/lighttpd_sa_2014_01.txt - http://www.debian.org/security/2014/dsa-2877 - http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00023.html - http://secunia.com/advisories/57514 - http://marc.info/?l=bugtraq&m=141576815022399&w=2 - http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00006.html - http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00002.html - http://secunia.com/advisories/57404 - http://seclists.org/oss-sec/2014/q1/564 - http://seclists.org/oss-sec/2014/q1/561 - http://jvn.jp/en/jp/JVN37417423/index.html
CVE ID: CVE-2014-2325 State: PUBLISHED Published: 2014-03-14T14:00:00 Last Updated: 2024-08-06T10:06:00.433Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Proxmox Mail Gateway before 3.1-5829 allow remote attackers to inject arbitrary web script or HTML via the (1) state parameter to objects/who/index.htm or (2) User email address to quarantine/spam/manage.htm. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/66169 - http://proxmox.com/news/archive/view/listid-1-proxmox-newsletter/mailid-48-proxmox-newsletter-march-2014-proxmox-ve-3-2-released/tmpl-component - http://seclists.
d-1-proxmox-newsletter/mailid-48-proxmox-newsletter-march-2014-proxmox-ve-3-2-released/tmpl-component - http://seclists.org/fulldisclosure/2014/Mar/110
CVE ID: CVE-2014-2326 State: PUBLISHED Published: 2014-03-27T16:00:00 Last Updated: 2024-08-06T10:06:00.426Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in cdef.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://svn.cacti.net/viewvc?view=rev&revision=7443 - http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131821.html - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742768 - http://www.securityfocus.com/archive/1/531588 - http://secunia.com/advisories/59203 - http://b