Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2014-9570 State: PUBLISHED Published: 2015-01-15T15:00:00 Last Updated: 2024-08-06T13:47:41.621Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the MyWebsiteAdvisor Simple Security plugin 1.1.5 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) datefilter parameter in the access_log page to wp-admin/users.php or (2) simple_security_ip_blacklist[] parameter in an add_blacklist_ip action in the ip_blacklist page to wp-admin/users.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.htbridge.com/advisory/HTB23244 - http://www.securityfocus.
yst Notes: - CVE Program Container: References: - https://www.htbridge.com/advisory/HTB23244 - http://www.securityfocus.com/archive/1/534477/100/0/threaded
CVE ID: CVE-2014-9571 State: PUBLISHED Published: 2015-01-26T15:00:00 Last Updated: 2024-08-06T13:47:41.726Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in admin/install.php in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote attackers to inject arbitrary web script or HTML via the (1) admin_username or (2) admin_password parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1031633 - https://exchange.xforce.ibmcloud.com/vulnerabilities/100209 - https://github.com/mantisbt/mantisbt/commit/132cd6d0 - https://github.com/mantisbt/mantisbt/commit/6d47c047 - https://ww
https://github.com/mantisbt/mantisbt/commit/132cd6d0 - https://github.com/mantisbt/mantisbt/commit/6d47c047 - https://www.mantisbt.org/bugs/view.php?id=17938 - https://www.htbridge.com/advisory/HTB23243 - http://seclists.org/oss-sec/2015/q1/156 - https://www.mantisbt.org/bugs/view.php?id=17937
CVE ID: CVE-2014-9572 State: PUBLISHED Published: 2015-01-26T15:00:00 Last Updated: 2024-08-06T13:47:41.829Z Vendors: n/a Products: n/a Problem Types: n/a Description: MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 does not properly restrict access to /*/install.php, which allows remote attackers to obtain database credentials via the install parameter with the value 4. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1031633 - http://seclists.org/oss-sec/2015/q1/158 - https://exchange.xforce.ibmcloud.com/vulnerabilities/100211 - https://www.htbridge.com/advisory/HTB23243 - https://www.mantisbt.org/bugs/view.php?id=17939 - https://www.m
es/100211 - https://www.htbridge.com/advisory/HTB23243 - https://www.mantisbt.org/bugs/view.php?id=17939 - https://www.mantisbt.org/bugs/view.php?id=17937
CVE ID: CVE-2014-9573 State: PUBLISHED Published: 2015-01-26T15:00:00 Last Updated: 2024-08-06T13:47:41.835Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in manage_user_page.php in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote administrators with FILE privileges to execute arbitrary SQL commands via the MANTIS_MANAGE_USERS_COOKIE cookie. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1031633 - http://seclists.org/oss-sec/2015/q1/157 - https://github.com/mantisbt/mantisbt/commit/7cc4539f - https://exchange.xforce.ibmcloud.com/vulnerabilities/100210 - https://www.htbridge.com/advi
t/mantisbt/commit/7cc4539f - https://exchange.xforce.ibmcloud.com/vulnerabilities/100210 - https://www.htbridge.com/advisory/HTB23243 - https://github.com/mantisbt/mantisbt/commit/69c2d28d - https://www.mantisbt.org/bugs/view.php?id=17937 - https://www.mantisbt.org/bugs/view.php?id=17940
CVE ID: CVE-2014-9574 State: PUBLISHED Published: 2015-02-03T16:00:00 Last Updated: 2024-08-06T13:47:41.660Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in install.php in FluxBB before 1.5.8 allows remote attackers to include and execute arbitrary local install.php files via a .. (dot dot) in the install_lang parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/100506 - https://www.htbridge.com/advisory/HTB23246 - https://fluxbb.org/forums/viewtopic.php?id=8203
CVE ID: CVE-2014-9575 State: PUBLISHED Published: 2015-01-08T15:00:00Z Last Updated: 2024-09-16T20:41:58.915Z Vendors: n/a Products: n/a Problem Types: n/a Description: VDG Security SENSE (formerly DIVA) before 2.3.15 allows remote attackers to bypass authentication, and consequently read and modify arbitrary plugin settings, via an encoded : (colon) character in the Authorization HTTP header. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2014/Dec/76 - https://vdgsecurity.com/downloads/software/?file=1.+DIVA+2.3%2F2.+Changelog+2.3.16.txt - http://packetstormsecurity.com/files/129656/VDG-Security-SENSE-2.3.13-File-Disclosure-Bypass-Buffer-
ngelog+2.3.16.txt - http://packetstormsecurity.com/files/129656/VDG-Security-SENSE-2.3.13-File-Disclosure-Bypass-Buffer-Overflow.html - https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20141218-0_VDG_Security_SENSE_Multiple_critical_vulnerabilities_v10.txt
CVE ID: CVE-2014-9576 State: PUBLISHED Published: 2015-01-08T15:00:00Z Last Updated: 2024-09-17T02:52:56.648Z Vendors: n/a Products: n/a Problem Types: n/a Description: VDG Security SENSE (formerly DIVA) 2.3.13 has a hardcoded password of (1) ArpaRomaWi for the root Postgres account and !DVService for the (2) postgres and (3) NTP Windows user accounts, which allows remote attackers to obtain access. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2014/Dec/76 - http://packetstormsecurity.com/files/129656/VDG-Security-SENSE-2.3.13-File-Disclosure-Bypass-Buffer-Overflow.html - https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_
2.3.13-File-Disclosure-Bypass-Buffer-Overflow.html - https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20141218-0_VDG_Security_SENSE_Multiple_critical_vulnerabilities_v10.txt
CVE ID: CVE-2014-9577 State: PUBLISHED Published: 2015-01-08T15:00:00Z Last Updated: 2024-09-16T23:50:25.923Z Vendors: n/a Products: n/a Problem Types: n/a Description: VDG Security SENSE (formerly DIVA) 2.3.13 sends the user database when a user logs in, which allows remote authenticated users to obtain usernames and password hashes by logging in to TCP port 51410 and reading the response. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2014/Dec/76 - http://packetstormsecurity.com/files/129656/VDG-Security-SENSE-2.3.13-File-Disclosure-Bypass-Buffer-Overflow.html - https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20141
le-Disclosure-Bypass-Buffer-Overflow.html - https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20141218-0_VDG_Security_SENSE_Multiple_critical_vulnerabilities_v10.txt
CVE ID: CVE-2014-9578 State: PUBLISHED Published: 2015-01-08T15:00:00 Last Updated: 2024-08-06T13:47:41.788Z Vendors: n/a Products: n/a Problem Types: n/a Description: VDG Security SENSE (formerly DIVA) 2.3.13 performs authentication with a password hash instead of a password, which allows remote attackers to gain login access by leveraging knowledge of a password hash. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2014/Dec/76 - http://packetstormsecurity.com/files/129656/VDG-Security-SENSE-2.3.13-File-Disclosure-Bypass-Buffer-Overflow.html - https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20141218-0_VDG_Security_SE
Buffer-Overflow.html - https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20141218-0_VDG_Security_SENSE_Multiple_critical_vulnerabilities_v10.txt
CVE ID: CVE-2014-9579 State: PUBLISHED Published: 2015-01-08T15:00:00Z Last Updated: 2024-09-16T23:35:35.222Z Vendors: n/a Products: n/a Problem Types: n/a Description: VDG Security SENSE (formerly DIVA) 2.3.13 stores administrator credentials in cleartext, which allows attackers to obtain sensitive information by reading the plugin configuration files. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2014/Dec/76 - http://packetstormsecurity.com/files/129656/VDG-Security-SENSE-2.3.13-File-Disclosure-Bypass-Buffer-Overflow.html - https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20141218-0_VDG_Security_SENSE_Multiple_crit
tml - https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20141218-0_VDG_Security_SENSE_Multiple_critical_vulnerabilities_v10.txt
CVE ID: CVE-2014-9580 State: PUBLISHED Published: 2015-01-08T19:00:00 Last Updated: 2024-08-06T13:47:41.824Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) r561 allows remote attackers to inject arbitrary web script or HTML via the Description field in a file upload. NOTE: this issue was originally incorrectly mapped to CVE-2014-1155; see CVE-2014-1155 for more information. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/35582 - http://packetstormsecurity.com/files/129666 - https://exchange.xforce.ibmcloud.com/vulnerabilities/99550
CVE ID: CVE-2014-9581 State: PUBLISHED Published: 2015-01-08T20:00:00 Last Updated: 2024-08-06T13:47:41.720Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in components/filemanager/download.php in Codiad 2.4.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the path parameter. NOTE: this issue was originally incorrectly mapped to CVE-2014-1137; see CVE-2014-1137 for more information. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/35585
CVE ID: CVE-2014-9582 State: PUBLISHED Published: 2015-01-08T20:00:00 Last Updated: 2024-08-06T13:47:41.675Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in components/filemanager/dialog.php in Codiad 2.4.3 allows remote attackers to inject arbitrary web script or HTML via the short_name parameter in a rename action. NOTE: this issue was originally incorrectly mapped to CVE-2014-1137; see CVE-2014-1137 for more information. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/35585
CVE ID: CVE-2014-9583 State: PUBLISHED Published: 2015-01-08T20:00:00 Last Updated: 2024-08-06T13:47:41.675Z Vendors: n/a Products: n/a Problem Types: n/a Description: common.c in infosvr in ASUS WRT firmware 3.0.0.4.376_1071, 3.0.0.376.2524-g0013f52, and other versions, as used in RT-AC66U, RT-N66U, and other routers, does not properly check the MAC address for a request, which allows remote attackers to bypass authentication and execute arbitrary commands via a NET_CMD_ID_MANU_CMD packet to UDP port 9999. NOTE: this issue was incorrectly mapped to CVE-2014-10000, but that ID is invalid due to its use as an example of the 2014 CVE ID syntax change. Additional Analyst Notes: - CVE Program Co
ID is invalid due to its use as an example of the 2014 CVE ID syntax change. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/35688 - https://www.exploit-db.com/exploits/44524/ - https://support.t-mobile.com/docs/DOC-21994 - https://github.com/jduck/asus-cmd - http://packetstormsecurity.com/files/129815/ASUSWRT-3.0.0.4.376_1071-LAN-Backdoor-Command-Execution.html
CVE ID: CVE-2014-9584 State: PUBLISHED Published: 2015-01-09T21:00:00 Last Updated: 2024-08-06T13:47:41.674Z Vendors: n/a Products: n/a Problem Types: n/a Description: The parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel before 3.18.2 does not validate a length value in the Extensions Reference (ER) System Use Field, which allows local users to obtain sensitive information from kernel memory via a crafted iso9660 image. Additional Analyst Notes: - CVE Program Container: References: - http://www.ubuntu.com/usn/USN-2515-1 - http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00015.html - https://bugzilla.redhat.com/show_bug.cgi?id=1180119 - http://lis
.org/opensuse-security-announce/2015-04/msg00015.html - https://bugzilla.redhat.com/show_bug.cgi?id=1180119 - http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00000.html - http://www.ubuntu.com/usn/USN-2512-1 - http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html - http://www.openwall.com/lists/oss-security/2015/01/09/4 - http://www.ubuntu.com/usn/USN-2514-1 - http://rhn.redhat.com/errata/RHSA-2015-1138.html - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=4e2024624e678f0ebb916e6192bd23c1f9fdf696 - http://www.ubuntu.com/usn/USN-2518-1 - http://rhn.redhat.com/errata/RHSA-2015-0864.html - http://lists.opensuse.org/o
- http://www.ubuntu.com/usn/USN-2518-1 - http://rhn.redhat.com/errata/RHSA-2015-0864.html - http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.html - http://www.mandriva.com/security/advisories?name=MDVSA-2015:058 - https://github.com/torvalds/linux/commit/4e2024624e678f0ebb916e6192bd23c1f9fdf696 - http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.html - http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.18.2 - http://www.securityfocus.com/bid/71883 - http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00020.html - http://www.ubuntu.com/usn/USN-2517-1 - http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00009.html - http:/
tp://www.ubuntu.com/usn/USN-2517-1 - http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00009.html - http://www.debian.org/security/2015/dsa-3128 - http://www.ubuntu.com/usn/USN-2516-1 - http://rhn.redhat.com/errata/RHSA-2015-1137.html - http://www.ubuntu.com/usn/USN-2513-1 - http://www.ubuntu.com/usn/USN-2511-1 - http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html
CVE ID: CVE-2014-9585 State: PUBLISHED Published: 2015-01-09T21:00:00 Last Updated: 2024-08-06T13:47:41.817Z Vendors: n/a Products: n/a Problem Types: n/a Description: The vdso_addr function in arch/x86/vdso/vma.c in the Linux kernel through 3.18.2 does not properly choose memory locations for the vDSO area, which makes it easier for local users to bypass the ASLR protection mechanism by guessing a location at the end of a PMD. Additional Analyst Notes: - CVE Program Container: References: - http://git.kernel.org/?p=linux/kernel/git/tip/tip.git%3Ba=commit%3Bh=fbe1bf140671619508dfa575d74a185ae53c5dbb - http://www.ubuntu.com/usn/USN-2515-1 - http://www.debian.org/security/2015/dsa-3170 - http:
9508dfa575d74a185ae53c5dbb - http://www.ubuntu.com/usn/USN-2515-1 - http://www.debian.org/security/2015/dsa-3170 - http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00015.html - http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00000.html - http://rhn.redhat.com/errata/RHSA-2015-1778.html - http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00035.html - http://www.ubuntu.com/usn/USN-2514-1 - http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148480.html - http://www.openwall.com/lists/oss-security/2015/01/09/8 - http://www.ubuntu.com/usn/USN-2518-1 - http://rhn.redhat.com/errata/RHSA-2015-1787.html - http://lists.opensuse.org/opens
ttp://www.ubuntu.com/usn/USN-2518-1 - http://rhn.redhat.com/errata/RHSA-2015-1787.html - http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.html - http://www.mandriva.com/security/advisories?name=MDVSA-2015:058 - http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.html - http://www.securityfocus.com/bid/71990 - http://www.openwall.com/lists/oss-security/2014/12/09/10 - http://www.ubuntu.com/usn/USN-2517-1 - http://v0ids3curity.blogspot.in/2014/12/return-to-vdso-using-elf-auxiliary.html - http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00009.html - http://www.ubuntu.com/usn/USN-2516-1 - http://www.ubuntu.com/usn/USN-2513-1 - http://git.kern
ce/2015-04/msg00009.html - http://www.ubuntu.com/usn/USN-2516-1 - http://www.ubuntu.com/usn/USN-2513-1 - http://git.kernel.org/?p=linux/kernel/git/luto/linux.git%3Ba=commit%3Bh=bc3b94c31d65e761ddfe150d02932c65971b74e2 - http://rhn.redhat.com/errata/RHSA-2015-1081.html
CVE ID: CVE-2014-9587 State: PUBLISHED Published: 2015-01-15T15:00:00 Last Updated: 2024-08-06T13:47:41.677Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Roundcube Webmail before 1.0.4 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, related to (1) address book operations or the (2) ACL or (3) Managesieve plugins. Additional Analyst Notes: - CVE Program Container: References: - http://roundcube.net/news/2014/12/18/update-1.0.4-released/ - https://bugzilla.redhat.com/show_bug.cgi?id=1179780 - https://bugs.gentoo.org/show_bug.cgi?id=534766 - http://www.securityfocus.com/bi
la.redhat.com/show_bug.cgi?id=1179780 - https://bugs.gentoo.org/show_bug.cgi?id=534766 - http://www.securityfocus.com/bid/71909 - http://www.openwall.com/lists/oss-security/2015/01/11/3
CVE ID: CVE-2014-9588 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2014-9589 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2014-9590 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2014-9591 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2014-9592 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2014-9593 State: PUBLISHED Published: 2015-01-15T15:00:00Z Last Updated: 2024-09-16T16:38:52.645Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apache CloudStack before 4.3.2 and 4.4.x before 4.4.2 allows remote attackers to obtain private keys via a listSslCerts API call. Additional Analyst Notes: - CVE Program Container: References: - http://docs.cloudstack.apache.org/projects/cloudstack-release-notes/en/4.3.2/about.html - http://docs.cloudstack.apache.org/projects/cloudstack-release-notes/en/4.4.2/fixed_issues.html#issues-fixed-in-release - http://secunia.com/advisories/62216 - https://issues.apache.org/jira/browse/CLOUDSTACK-7952
CVE ID: CVE-2014-9594 State: PUBLISHED Published: 2015-01-15T15:00:00 Last Updated: 2024-08-06T13:47:41.780Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the SAP NetWeaver Dispatcher in SAP Kernel 7.00 32-bit and 7.40 64-bit allows remote authenticated users to cause a denial of service or possibly execute arbitrary code via unspecified vectors, related to the ABAP VM, aka SAP Note 2059734. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/62150 - https://erpscan.io/advisories/erpscan-14-025-sap-kernel-rce-dos/ - https://erpscan.io/press-center/blog/sap-critical-patch-update-december-2014/
CVE ID: CVE-2014-9595 State: PUBLISHED Published: 2015-01-15T15:00:00 Last Updated: 2024-08-06T13:47:41.666Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the SAP NetWeaver Dispatcher in SAP Kernel 7.00 32-bit and 7.40 64-bit allows remote authenticated users to cause a denial of service or possibly execute arbitrary code via unspecified vectors, related to the Spool System, aka SAP Note 2061271. Additional Analyst Notes: - CVE Program Container: References: - https://erpscan.io/advisories/erpscan-14-024-sap-kernel-rce-dos/ - http://secunia.com/advisories/62150 - https://erpscan.io/press-center/blog/sap-critical-patch-update-december-2014/
CVE ID: CVE-2014-9596 State: PUBLISHED Published: 2015-01-15T23:00:00Z Last Updated: 2024-09-17T00:05:38.621Z Vendors: n/a Products: n/a Problem Types: n/a Description: Panasonic Arbitrator Back-End Server (BES) MK 2.0 VPU before 9.3.1 build 4.08.003.0, when USB Wi-Fi or Direct LAN is enabled, and MK 3.0 VPU before 9.3.1 build 5.06.000.0, when Embedded Wi-Fi or Direct LAN is enabled, does not use encryption, which allows remote attackers to obtain sensitive information by sniffing the network for client-server traffic, as demonstrated by Active Directory credential information. Additional Analyst Notes: - CVE Program Container: References: - http://us2.campaign-archive1.com/?u=8c9cff2e712e3b
ion. Additional Analyst Notes: - CVE Program Container: References: - http://us2.campaign-archive1.com/?u=8c9cff2e712e3b7d09a07ecef&id=21f059b3ab - http://www.kb.cert.org/vuls/id/117604
CVE ID: CVE-2014-9597 State: PUBLISHED Published: 2015-01-21T11:00:00 Last Updated: 2024-08-06T13:47:41.681Z Vendors: n/a Products: n/a Problem Types: n/a Description: The picture_pool_Delete function in misc/picture_pool.c in VideoLAN VLC media player 2.1.5 allows remote attackers to execute arbitrary code or cause a denial of service (DEP violation and application crash) via a crafted FLV file. Additional Analyst Notes: - CVE Program Container: References: - http://www.binarysniper.net/2015/01/vlc-media-player-215-memory-corruption.html - http://seclists.org/fulldisclosure/2015/Jan/72 - https://security.gentoo.org/glsa/201603-08 - https://trac.videolan.org/vlc/ticket/13389 - https://trac.v
e/2015/Jan/72 - https://security.gentoo.org/glsa/201603-08 - https://trac.videolan.org/vlc/ticket/13389 - https://trac.videolan.org/vlc/attachment/ticket/13389/windbglog.txt
CVE ID: CVE-2014-9598 State: PUBLISHED Published: 2015-01-21T11:00:00 Last Updated: 2024-08-06T13:47:41.656Z Vendors: n/a Products: n/a Problem Types: n/a Description: The picture_Release function in misc/picture.c in VideoLAN VLC media player 2.1.5 allows remote attackers to execute arbitrary code or cause a denial of service (write access violation) via a crafted M2V file. Additional Analyst Notes: - CVE Program Container: References: - http://www.binarysniper.net/2015/01/vlc-media-player-215-memory-corruption.html - https://trac.videolan.org/vlc/ticket/13390 - http://seclists.org/fulldisclosure/2015/Jan/72 - https://security.gentoo.org/glsa/201603-08 - https://trac.videolan.org/vlc/attach
lists.org/fulldisclosure/2015/Jan/72 - https://security.gentoo.org/glsa/201603-08 - https://trac.videolan.org/vlc/attachment/ticket/13390/windbglog.txt
CVE ID: CVE-2014-9599 State: PUBLISHED Published: 2015-01-16T15:00:00 Last Updated: 2024-08-06T13:47:41.783Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the filemanager in b2evolution before 5.2.1 allows remote attackers to inject arbitrary web script or HTML via the fm_filter parameter to blogs/admin.php. Additional Analyst Notes: - CVE Program Container: References: - http://b2evolution.net/downloads/5-2-1-stable - http://sroesemann.blogspot.de/2014/12/sroeadv-2014-09.html - http://seclists.org/fulldisclosure/2015/Jan/48 - https://twitter.com/SecLists/status/554937224366546944 - http://sroesemann.blogspot.de/2015/01/report-for-advi
/Jan/48 - https://twitter.com/SecLists/status/554937224366546944 - http://sroesemann.blogspot.de/2015/01/report-for-advisory-sroeadv-2014-09.html - http://www.securityfocus.com/bid/72052 - https://exchange.xforce.ibmcloud.com/vulnerabilities/99891 - http://packetstormsecurity.com/files/129940/CMS-b2evolution-5.2.0-Cross-Site-Scripting.html
CVE ID: CVE-2014-9600 State: PUBLISHED Published: 2015-01-16T15:00:00 Last Updated: 2024-08-06T13:47:41.627Z Vendors: n/a Products: n/a Problem Types: n/a Description: Untrusted search path vulnerability in Macroplant iExplorer 3.6.3.0 allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse itunesmobiledevice.dll. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/129764/iExplorer-3.6.3.0-DLL-Hijacking.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/99833