Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2014-8654 State: PUBLISHED Published: 2014-11-06T15:00:00 Last Updated: 2024-08-06T13:26:02.358Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway hardware 1.0 with firmware CH6640-3.5.11.7-NOSH allow remote attackers to hijack the authentication of administrators for requests that (1) have unspecified impact on DDNS configuration via a request to basicDDNS.html, (2) change the wifi password via the psKey parameter to setWirelessSecurity.html, (3) add a static MAC address via the MacAddress parameter in an add_static action to setBasicDHCP1.h
elessSecurity.html, (3) add a static MAC address via the MacAddress parameter in an add_static action to setBasicDHCP1.html, or (4) enable or disable UPnP via the UPnP parameter in an apply action to setAdvancedOptions.html. Additional Analyst Notes: - CVE Program Container: References: - http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5203.php - http://www.securityfocus.com/bid/70762 - http://osvdb.org/show/osvdb/113843 - https://exchange.xforce.ibmcloud.com/vulnerabilities/98329 - http://osvdb.org/show/osvdb/113842 - http://osvdb.org/show/osvdb/113841 - http://www.exploit-db.com/exploits/35075 - http://osvdb.org/show/osvdb/113840 - http://packetstormsecurity.com/files/128860/CBN-CH66
xploit-db.com/exploits/35075 - http://osvdb.org/show/osvdb/113840 - http://packetstormsecurity.com/files/128860/CBN-CH6640E-CG6640E-Wireless-Gateway-XSS-CSRF-DoS-Disclosure.html
CVE ID: CVE-2014-8655 State: PUBLISHED Published: 2014-11-06T15:00:00 Last Updated: 2024-08-06T13:26:02.088Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640-3.5.11.7-NOSH allows remote attackers to bypass authentication and obtain sensitive information via an (a) admin or a (b) root value in the userData cookie in a request to (1) CmgwWirelessSecurity.xml, (2) DocsisConfigFile.xml, or (3) CmgwBasicSetup.xml in xml/ or (4) basicDDNS.html, (5) basicLanUsers.html, or (6) rootDesc.xml. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/70762
) rootDesc.xml. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/70762 - http://osvdb.org/show/osvdb/113837 - http://www.exploit-db.com/exploits/35075 - https://exchange.xforce.ibmcloud.com/vulnerabilities/98331 - http://packetstormsecurity.com/files/128860/CBN-CH6640E-CG6640E-Wireless-Gateway-XSS-CSRF-DoS-Disclosure.html
CVE ID: CVE-2014-8656 State: PUBLISHED Published: 2014-11-06T15:00:00Z Last Updated: 2024-09-17T04:24:15.551Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640-3.5.11.7-NOSH have a default password of (1) admin for the admin account and (2) compalbn for the root account, which makes it easier for remote attackers to obtain access to certain sensitive information via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5203.php - http://www.exploit-db.com/exploits/35075 - http://packetstormsecurity.com
ence.mk/en/vulnerabilities/ZSL-2014-5203.php - http://www.exploit-db.com/exploits/35075 - http://packetstormsecurity.com/files/128860/CBN-CH6640E-CG6640E-Wireless-Gateway-XSS-CSRF-DoS-Disclosure.html - http://osvdb.org/show/osvdb/113836
CVE ID: CVE-2014-8657 State: PUBLISHED Published: 2014-11-06T15:00:00 Last Updated: 2024-08-06T13:26:01.844Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640-3.5.11.7-NOSH allows remote attackers to cause a denial of service (disconnect all wifi clients) via a request to wirelessChannelStatus.html. Additional Analyst Notes: - CVE Program Container: References: - http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5203.php - https://exchange.xforce.ibmcloud.com/vulnerabilities/98330 - http://osvdb.org/show/osvdb/113838 - http://www.exploit-db.com/exploits/35075 - http://packetstormsec
rabilities/98330 - http://osvdb.org/show/osvdb/113838 - http://www.exploit-db.com/exploits/35075 - http://packetstormsecurity.com/files/128860/CBN-CH6640E-CG6640E-Wireless-Gateway-XSS-CSRF-DoS-Disclosure.html
CVE ID: CVE-2014-8658 State: PUBLISHED Published: 2014-11-06T15:00:00 Last Updated: 2024-08-06T13:26:02.354Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in RefinedWiki Original Theme 3.x before 3.5.13 and 4.x before 4.0.12 for Confluence allows remote authenticated users with permissions to create or edit content to inject arbitrary web script or HTML via the versionComment parameter to pages/doeditpage.action. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/70798 - http://seclists.org/fulldisclosure/2014/Oct/126 - https://exchange.xforce.ibmcloud.com/vulnerabilities/98401 - http://www.s
p://seclists.org/fulldisclosure/2014/Oct/126 - https://exchange.xforce.ibmcloud.com/vulnerabilities/98401 - http://www.securityfocus.com/archive/1/533845/100/0/threaded - http://demo.refinedwiki.com/display/rwot/Version+4.0.12 - http://packetstormsecurity.com/files/128907/Confluence-RefinedWiki-Original-Theme-Cross-Site-Scripting.html - https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20141029-1_RefinedWiki-OriginalTheme_Persistent-Cross-Site-Scripting_v10.txt
CVE ID: CVE-2014-8659 State: PUBLISHED Published: 2014-11-06T15:00:00 Last Updated: 2024-08-06T13:26:02.299Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in SAP Environment, Health, and Safety allows remote attackers to read arbitrary files via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://erpscan.io/press-center/blog/sap-critical-patch-update-october-2014/ - http://blog.onapsis.com/analyzing-sap-security-notes-october-2014-edition/ - http://service.sap.com/sap/support/notes/0002052082
CVE ID: CVE-2014-8660 State: PUBLISHED Published: 2014-11-06T15:00:00 Last Updated: 2024-08-06T13:26:02.484Z Vendors: n/a Products: n/a Problem Types: n/a Description: SAP Document Management Services allows local users to execute arbitrary commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://erpscan.io/press-center/blog/sap-critical-patch-update-october-2014/ - http://blog.onapsis.com/analyzing-sap-security-notes-october-2014-edition/ - https://service.sap.com/sap/support/notes/1906212
CVE ID: CVE-2014-8661 State: PUBLISHED Published: 2014-11-06T15:00:00Z Last Updated: 2024-09-16T17:27:48.652Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SAP CRM Internet Sales module allows remote attackers to execute arbitrary commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://service.sap.com/sap/support/notes/0002043404 - http://blog.onapsis.com/analyzing-sap-security-notes-october-2014-edition/
CVE ID: CVE-2014-8662 State: PUBLISHED Published: 2014-11-06T15:00:00Z Last Updated: 2024-09-17T01:20:53.032Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in SAP Payroll Process allows remote attackers to cause a denial of service via vectors related to session handling. Additional Analyst Notes: - CVE Program Container: References: - http://service.sap.com/sap/support/notes/0002076845 - http://blog.onapsis.com/analyzing-sap-security-notes-october-2014-edition/
CVE ID: CVE-2014-8663 State: PUBLISHED Published: 2014-11-06T15:00:00Z Last Updated: 2024-09-16T23:06:32.961Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Data Basis (BW-WHM-DBA) in SAP NetWeaver Business Warehouse allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://service.sap.com/sap/support/notes/0001965819 - http://blog.onapsis.com/analyzing-sap-security-notes-october-2014-edition/
CVE ID: CVE-2014-8664 State: PUBLISHED Published: 2014-11-06T15:00:00 Last Updated: 2024-08-06T13:26:01.800Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Product Safety (EHS-SAF) component in SAP Environment, Health, and Safety Management allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/98611 - http://blog.onapsis.com/analyzing-sap-security-notes-october-2014-edition/ - http://service.sap.com/sap/support/notes/0001810405 - http://www.securityfocus.com/bid/71025
CVE ID: CVE-2014-8665 State: PUBLISHED Published: 2014-11-06T15:00:00Z Last Updated: 2024-09-16T19:30:19.583Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SAP Business Intelligence Development Workbench allows remote attackers to obtain sensitive information by reading unspecified files. Additional Analyst Notes: - CVE Program Container: References: - http://service.sap.com/sap/support/notes/0002018682 - http://blog.onapsis.com/analyzing-sap-security-notes-october-2014-edition/
CVE ID: CVE-2014-8666 State: PUBLISHED Published: 2014-11-06T15:00:00Z Last Updated: 2024-09-16T17:27:56.331Z Vendors: n/a Products: n/a Problem Types: n/a Description: The User & Server configuration, InfoView refresh, user rights (BI-BIP-ADM) component in SAP Business Intellignece allows remote attackers to obtain audit event details via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://blog.onapsis.com/analyzing-sap-security-notes-october-2014-edition/ - http://service.sap.com/sap/support/notes/0002011395
CVE ID: CVE-2014-8667 State: PUBLISHED Published: 2014-11-06T15:00:00Z Last Updated: 2024-09-17T00:56:50.381Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in SAP HANA Web-based Development Workbench allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://service.sap.com/sap/support/notes/0002069676 - http://blog.onapsis.com/analyzing-sap-security-notes-october-2014-edition/
CVE ID: CVE-2014-8668 State: PUBLISHED Published: 2014-11-06T15:00:00 Last Updated: 2024-08-06T13:26:02.249Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in SAP Contract Accounting allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/71032 - http://blog.onapsis.com/analyzing-sap-security-notes-october-2014-edition/ - http://service.sap.com/sap/support/notes/0002022179 - https://exchange.xforce.ibmcloud.com/vulnerabilities/98612
CVE ID: CVE-2014-8669 State: PUBLISHED Published: 2014-11-06T15:00:00Z Last Updated: 2024-09-17T02:57:32.799Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SAP Promotion Guidelines (CRM-MKT-MPL-TPM-PPG) module for SAP CRM allows remote attackers to execute arbitrary code via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://service.sap.com/sap/support/notes/0001872638 - http://blog.onapsis.com/analyzing-sap-security-notes-october-2014-edition/ - http://service.sap.com/sap/support/notes/0001835691
CVE ID: CVE-2014-8670 State: PUBLISHED Published: 2014-11-06T15:00:00 Last Updated: 2024-08-06T13:26:02.520Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open redirect vulnerability in go.php in vBulletin 4.2.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/70906 - http://packetstormsecurity.com/files/128958/vBulletin-4.2.1-Open-Redirect.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/98476
CVE ID: CVE-2014-8671 State: PUBLISHED Published: 2014-11-07T11:00:00Z Last Updated: 2024-09-17T03:08:18.979Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the GWT Mobile PhoneGap Showcase application for Android allows remote attackers to inject arbitrary web script or HTML via a crafted Bluetooth Device Name field. Additional Analyst Notes: - CVE Program Container: References: - http://arxiv.org/pdf/1410.7756v1.pdf - http://arxiv.org/abs/1410.7756
CVE ID: CVE-2014-8672 State: PUBLISHED Published: 2014-11-07T11:00:00Z Last Updated: 2024-09-16T22:36:08.895Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the RewardingYourself application for Android and BlackBerry OS allows remote attackers to inject arbitrary web script or HTML via a crafted QR code. Additional Analyst Notes: - CVE Program Container: References: - http://arxiv.org/pdf/1410.7756v1.pdf - http://arxiv.org/abs/1410.7756
CVE ID: CVE-2014-8673 State: PUBLISHED Published: 2020-01-07T17:27:23 Last Updated: 2024-08-06T13:26:00.842Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL vulnerabilities exist in planning.php, user_list.php, projets.php, user_groupes.php, and groupe_list.php in Simple Online Planning (SOPPlanning)before 1.33. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/132654/Simple-Online-Planning-Tool-1.3.2-XSS-SQL-Injection-Traversal.html - http://www.securityfocus.com/bid/75726 - http://seclists.org/fulldisclosure/2015/Jul/44 - https://www.exploit-db.com/exploits/37604/
CVE ID: CVE-2014-8674 State: PUBLISHED Published: 2020-01-06T21:40:51 Last Updated: 2024-08-06T13:26:02.369Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple Cross-Site Scripting (XSS) vulnerabilities exist in Simple Online Planning (SOPlanning) before 1.33 via the document.cookie in nb_mois and mb_ligness and the debug GET parameter to export.php, which allows malicious users to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/132654/Simple-Online-Planning-Tool-1.3.2-XSS-SQL-Injection-Traversal.html - http://www.securityfocus.com/bid/75726 - http://seclists.org/fulldisclosure/2015/Jul/44 - https:
ection-Traversal.html - http://www.securityfocus.com/bid/75726 - http://seclists.org/fulldisclosure/2015/Jul/44 - https://www.exploit-db.com/exploits/37604/
CVE ID: CVE-2014-8675 State: PUBLISHED Published: 2017-08-31T22:00:00 Last Updated: 2024-08-06T13:26:02.190Z Vendors: n/a Products: n/a Problem Types: n/a Description: Soplanning 1.32 and earlier generates static links for sharing ICAL calendars with embedded login information, which allows remote attackers to obtain a calendar owner's password via a brute-force attack on the embedded password hash. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/75726 - http://packetstormsecurity.com/files/132654/Simple-Online-Planning-Tool-1.3.2-XSS-SQL-Injection-Traversal.html - https://www.exploit-db.com/exploits/37604/ - http://seclists.org/fulldisclosur
-1.3.2-XSS-SQL-Injection-Traversal.html - https://www.exploit-db.com/exploits/37604/ - http://seclists.org/fulldisclosure/2015/Jul/44
CVE ID: CVE-2014-8676 State: PUBLISHED Published: 2017-08-31T22:00:00 Last Updated: 2024-08-06T13:26:02.499Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the file_get_contents function in SOPlanning 1.32 and earlier allows remote attackers to determine the existence of arbitrary files via a .. (dot dot) in a URL path parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/75726 - http://packetstormsecurity.com/files/132654/Simple-Online-Planning-Tool-1.3.2-XSS-SQL-Injection-Traversal.html - https://www.exploit-db.com/exploits/37604/ - http://seclists.org/fulldisclosure/2015/Jul/44
CVE ID: CVE-2014-8677 State: PUBLISHED Published: 2017-08-31T22:00:00 Last Updated: 2024-08-06T13:26:02.442Z Vendors: n/a Products: n/a Problem Types: n/a Description: The installation process for SOPlanning 1.32 and earlier allows remote authenticated users with a prepared database, and access to an existing database with a crafted name, or permissions to create arbitrary databases, or if PHP before 5.2 is being used, the configuration database is down, and smarty/templates_c is not writable to execute arbitrary php code via a crafted database name. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/75726 - http://packetstormsecurity.com/files/
s: - CVE Program Container: References: - http://www.securityfocus.com/bid/75726 - http://packetstormsecurity.com/files/132654/Simple-Online-Planning-Tool-1.3.2-XSS-SQL-Injection-Traversal.html - http://seclists.org/fulldisclosure/2015/Jul/44 - https://www.exploit-db.com/exploits/37604/
CVE ID: CVE-2014-8678 State: PUBLISHED Published: 2014-11-25T15:00:00 Last Updated: 2024-08-06T13:26:02.498Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ConfigSaveServlet servlet in ManageEngine OpUtils before build 71024 allows remote attackers to "disclose" files via a crafted filename, related to "saveFile." Additional Analyst Notes: - CVE Program Container: References: - http://www.zerodayinitiative.com/advisories/ZDI-14-386/
CVE ID: CVE-2014-8680 State: PUBLISHED Published: 2014-12-11T02:00:00 Last Updated: 2024-08-06T13:26:02.333Z Vendors: n/a Products: n/a Problem Types: n/a Description: The GeoIP functionality in ISC BIND 9.10.0 through 9.10.1 allows remote attackers to cause a denial of service (assertion failure and named exit) via vectors related to (1) the lack of GeoIP databases for both IPv4 and IPv6, or (2) IPv6 support with certain options. Additional Analyst Notes: - CVE Program Container: References: - http://security.gentoo.org/glsa/glsa-201502-03.xml - https://kb.isc.org/article/AA-01217 - https://security.netapp.com/advisory/ntap-20190730-0002/
CVE ID: CVE-2014-8681 State: PUBLISHED Published: 2014-11-21T15:00:00 Last Updated: 2024-08-06T13:26:02.357Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the GetIssues function in models/issue.go in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.6.x before 0.5.6.1025 Beta allows remote attackers to execute arbitrary SQL commands via the label parameter to user/repos/issues. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/98695 - https://github.com/gogits/gogs/commit/83283bca4cb4e0f4ec48a28af680f0d88db3d2c8 - http://seclists.org/fulldisclosure/2014/Nov/31 - http://gogs.io/docs/int
mmit/83283bca4cb4e0f4ec48a28af680f0d88db3d2c8 - http://seclists.org/fulldisclosure/2014/Nov/31 - http://gogs.io/docs/intro/change_log.html - http://packetstormsecurity.com/files/129116/Gogs-Label-Search-Blind-SQL-Injection.html - http://www.exploit-db.com/exploits/35237
CVE ID: CVE-2014-8682 State: PUBLISHED Published: 2014-11-21T15:00:00 Last Updated: 2024-08-06T13:26:02.264Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta allow remote attackers to execute arbitrary SQL commands via the q parameter to (1) api/v1/repos/search, which is not properly handled in models/repo.go, or (2) api/v1/users/search, which is not properly handled in models/user.go. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/35238 - https://exchange.xforce.ibmcloud.com/vulnerabilities/98694 - http://packetstorms
p://www.exploit-db.com/exploits/35238 - https://exchange.xforce.ibmcloud.com/vulnerabilities/98694 - http://packetstormsecurity.com/files/129117/Gogs-Repository-Search-SQL-Injection.html - http://seclists.org/fulldisclosure/2014/Nov/33 - http://gogs.io/docs/intro/change_log.html - http://www.securityfocus.com/archive/1/533995/100/0/threaded - http://www.securityfocus.com/bid/71187 - https://github.com/gogits/gogs/commit/0c5ba4573aecc9eaed669e9431a70a5d9f184b8d
CVE ID: CVE-2014-8683 State: PUBLISHED Published: 2014-11-21T15:00:00 Last Updated: 2024-08-06T13:26:02.380Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in models/issue.go in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.8 allows remote attackers to inject arbitrary web script or HTML via the text parameter to api/v1/markdown. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2014/Nov/34 - http://packetstormsecurity.com/files/129118/Gogs-Markdown-Renderer-Cross-Site-Scripting.html - http://gogs.io/docs/intro/change_log.html - https://exchange.xforce.ibmcloud.com/vulnerabilit
ross-Site-Scripting.html - http://gogs.io/docs/intro/change_log.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/98693 - http://www.securityfocus.com/archive/1/533996/100/0/threaded
CVE ID: CVE-2014-8684 State: PUBLISHED Published: 2017-09-19T19:00:00 Last Updated: 2024-08-06T13:26:02.543Z Vendors: n/a Products: n/a Problem Types: n/a Description: CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and consequently conduct PHP object injection attacks by leveraging use of standard string comparison operators to compare cryptographic hashes. Additional Analyst Notes: - CVE Program Container: References: - https://scott.arciszewski.me/research/full/php-framework-timing-attacks-object-injection - http://seclists.org/fulldisclosure/2014/May/54 - https://github.com/kohana/core/pull/492 - htt
ttacks-object-injection - http://seclists.org/fulldisclosure/2014/May/54 - https://github.com/kohana/core/pull/492 - http://packetstormsecurity.com/files/130609/Seagate-Business-NAS-Unauthenticated-Remote-Command-Execution.html
CVE ID: CVE-2014-8686 State: PUBLISHED Published: 2017-09-19T19:00:00 Last Updated: 2024-08-06T13:26:02.447Z Vendors: n/a Products: n/a Problem Types: n/a Description: CodeIgniter before 2.2.0 makes it easier for attackers to decode session cookies by leveraging fallback to a custom XOR-based encryption scheme when the Mcrypt extension for PHP is not available. Additional Analyst Notes: - CVE Program Container: References: - https://beyondbinary.io/articles/seagate-nas-rce/ - http://packetstormsecurity.com/files/130609/Seagate-Business-NAS-Unauthenticated-Remote-Command-Execution.html - https://www.dionach.com/blog/codeigniter-session-decoding-vulnerability - https://codeigniter.com/userguid
cution.html - https://www.dionach.com/blog/codeigniter-session-decoding-vulnerability - https://codeigniter.com/userguide2/changelog.html
CVE ID: CVE-2014-8687 State: PUBLISHED Published: 2017-06-08T16:00:00 Last Updated: 2024-08-06T13:26:02.506Z Vendors: n/a Products: n/a Problem Types: n/a Description: Seagate Business NAS devices with firmware before 2015.00322 allow remote attackers to execute arbitrary code with root privileges by leveraging use of a static encryption key to create session tokens. Additional Analyst Notes: - CVE Program Container: References: - https://beyondbinary.io/articles/seagate-nas-rce/ - http://www.securityfocus.com/bid/72831 - http://packetstormsecurity.com/files/130609/Seagate-Business-NAS-Unauthenticated-Remote-Command-Execution.html - http://packetstormsecurity.com/files/130585/Seagate-Busines
Business-NAS-Unauthenticated-Remote-Command-Execution.html - http://packetstormsecurity.com/files/130585/Seagate-Business-NAS-2014.00319-Remote-Code-Execution.html - https://www.exploit-db.com/exploits/36202/ - https://www.exploit-db.com/exploits/36264/