Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
1/100/0/threaded - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html - http://seclists.org/fulldisclosure/2014/Dec/23 - http://www.securitytracker.com/id/1030585
CVE ID: CVE-2014-2492 State: PUBLISHED Published: 2014-07-17T02:36:00 Last Updated: 2024-08-06T10:14:26.580Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in the Oracle Agile Product Collaboration component in Oracle Supply Chain Products Suite 9.3.3 allows remote attackers to affect integrity via unknown vectors related to Web client (PC). Additional Analyst Notes: - CVE Program Container: References: - http://www.vmware.com/security/advisories/VMSA-2014-0012.html - http://www.securitytracker.com/id/1030582 - http://www.securityfocus.com/archive/1/534161/100/0/threaded - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html - http:/
com/archive/1/534161/100/0/threaded - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html - http://seclists.org/fulldisclosure/2014/Dec/23
CVE ID: CVE-2014-2493 State: PUBLISHED Published: 2014-07-17T02:36:00 Last Updated: 2024-08-06T10:14:26.548Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in the Oracle JDeveloper component in Oracle Fusion Middleware 11.1.1.7.0, 11.1.2.4.0, and 12.1.2.0.0 allows remote attackers to affect confidentiality and availability via vectors related to ADF Faces. Additional Analyst Notes: - CVE Program Container: References: - http://www.vmware.com/security/advisories/VMSA-2014-0012.html - http://www.securityfocus.com/archive/1/534161/100/0/threaded - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html - http://seclists.org/fulldisclosure/
readed - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html - http://seclists.org/fulldisclosure/2014/Dec/23
CVE ID: CVE-2014-2494 State: PUBLISHED Published: 2014-07-17T02:36:00 Last Updated: 2024-08-06T10:14:26.659Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.37 and earlier allows remote authenticated users to affect availability via vectors related to ENARC. Additional Analyst Notes: - CVE Program Container: References: - http://www.vmware.com/security/advisories/VMSA-2014-0012.html - http://www.securityfocus.com/archive/1/534161/100/0/threaded - http://www.securitytracker.com/id/1030578 - http://lists.opensuse.org/opensuse-security-announce/2014-08/msg00012.html - http://lists.opensuse.org/opensuse-securi
- http://lists.opensuse.org/opensuse-security-announce/2014-08/msg00012.html - http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00016.html - http://www.debian.org/security/2014/dsa-2985 - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html - http://seclists.org/fulldisclosure/2014/Dec/23 - http://secunia.com/advisories/60425 - http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
CVE ID: CVE-2014-2495 State: PUBLISHED Published: 2014-07-17T02:36:00 Last Updated: 2024-08-06T10:14:26.579Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in the PeopleSoft Enterprise SCM Purchasing component in Oracle PeopleSoft Products 9.1 and 9.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Purchasing. Additional Analyst Notes: - CVE Program Container: References: - http://www.vmware.com/security/advisories/VMSA-2014-0012.html - http://www.securityfocus.com/archive/1/534161/100/0/threaded - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html - http://seclists.org/fulldisclosure/2014
ed - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html - http://seclists.org/fulldisclosure/2014/Dec/23 - http://www.securitytracker.com/id/1030586
CVE ID: CVE-2014-2496 State: PUBLISHED Published: 2014-07-17T02:36:00 Last Updated: 2024-08-06T10:14:26.620Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in the PeopleSoft Enterprise PT PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Test Framework. Additional Analyst Notes: - CVE Program Container: References: - http://www.vmware.com/security/advisories/VMSA-2014-0012.html - http://www.securityfocus.com/archive/1/534161/100/0/threaded - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html - http://seclists.org
/534161/100/0/threaded - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html - http://seclists.org/fulldisclosure/2014/Dec/23 - http://www.securitytracker.com/id/1030586
CVE ID: CVE-2014-2497 State: PUBLISHED Published: 2014-03-21T14:00:00 Last Updated: 2024-08-06T10:14:26.563Z Vendors: n/a Products: n/a Problem Types: n/a Description: The gdImageCreateFromXpm function in gdxpm.c in libgd, as used in PHP 5.4.26 and earlier, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted color table in an XPM file. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00001.html - http://www.mandriva.com/security/advisories?name=MDVSA-2015:153 - http://secunia.com/advisories/59418 - https://support.apple.com/HT204659 - http://secunia.
isories?name=MDVSA-2015:153 - http://secunia.com/advisories/59418 - https://support.apple.com/HT204659 - http://secunia.com/advisories/59496 - http://rhn.redhat.com/errata/RHSA-2014-1766.html - http://secunia.com/advisories/59652 - https://bugzilla.redhat.com/show_bug.cgi?id=1076676 - http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00002.html - http://www.debian.org/security/2015/dsa-3215 - http://secunia.com/advisories/59061 - https://security.gentoo.org/glsa/201607-04 - http://rhn.redhat.com/errata/RHSA-2014-1326.html - http://advisories.mageia.org/MGASA-2014-0288.html - http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html - http://www.securityfocus.com/
014-0288.html - http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html - http://www.securityfocus.com/bid/66233 - http://www.ubuntu.com/usn/USN-2987-1 - http://rhn.redhat.com/errata/RHSA-2014-1327.html - http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html - http://rhn.redhat.com/errata/RHSA-2014-1765.html - https://bugs.php.net/bug.php?id=66901
CVE ID: CVE-2014-2502 State: PUBLISHED Published: 2014-06-04T01:00:00 Last Updated: 2024-08-06T10:14:26.571Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in rsa_fso.swf in EMC RSA Adaptive Authentication (Hosted) 11.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://archives.neohapsis.com/archives/bugtraq/2014-06/0012.html - http://www.securitytracker.com/id/1030323 - http://www.securityfocus.com/bid/67792 - http://packetstormsecurity.com/files/126897/RSA-Adaptive-Authentication-Cross-Site-Scripting.html
CVE ID: CVE-2014-2503 State: PUBLISHED Published: 2014-06-06T00:00:00 Last Updated: 2024-08-06T10:14:26.605Z Vendors: n/a Products: n/a Problem Types: n/a Description: The thumbnail proxy server in EMC Documentum Digital Asset Manager (DAM) 6.5 SP3, 6.5 SP4, 6.5 SP5, and 6.5 SP6 before P13 allows remote attackers to conduct Documentum Query Language (DQL) injection attacks and bypass intended restrictions on querying objects via a crafted parameter in a query string. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/126947/EMC-Documentum-Digital-Asset-Manager-Blind-DQL-Injection.html - http://www.securitytracker.com/id/1030348 - http://www.
/EMC-Documentum-Digital-Asset-Manager-Blind-DQL-Injection.html - http://www.securitytracker.com/id/1030348 - http://www.securityfocus.com/bid/67868 - http://archives.neohapsis.com/archives/bugtraq/2014-06/0037.html
CVE ID: CVE-2014-2504 State: PUBLISHED Published: 2014-05-23T22:00:00 Last Updated: 2024-08-06T10:14:26.606Z Vendors: n/a Products: n/a Problem Types: n/a Description: EMC Documentum D2 3.1 before P20, 3.1 SP1 before P02, 4.0 before P10, 4.1 before P13, and 4.2 before P01 allows remote authenticated users to bypass intended access restrictions and execute arbitrary Documentum Query Language (DQL) queries by calling (1) a core method or (2) a D2FS web-service method. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/58938 - http://www.securitytracker.com/id/1030282 - http://archives.neohapsis.com/archives/bugtraq/current/0130.html
CVE ID: CVE-2014-2505 State: PUBLISHED Published: 2014-08-20T10:00:00 Last Updated: 2024-08-06T10:14:26.553Z Vendors: n/a Products: n/a Problem Types: n/a Description: EMC RSA Archer GRC Platform 5.x before 5.5 SP1 allows remote attackers to trigger the download of arbitrary code, and consequently change the product's functionality, via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/95360 - http://archives.neohapsis.com/archives/bugtraq/2014-08/0097.html - http://www.securitytracker.com/id/1030738 - http://www.securityfocus.com/bid/69290
CVE ID: CVE-2014-2506 State: PUBLISHED Published: 2014-06-08T01:00:00 Last Updated: 2024-08-06T10:14:26.584Z Vendors: n/a Products: n/a Problem Types: n/a Description: EMC Documentum Content Server before 6.7 SP1 P28, 6.7 SP2 before P14, 7.0 before P15, and 7.1 before P05 allows remote authenticated users to obtain super-user privileges for system-object creation, and bypass intended restrictions on data access and server actions, via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/67917 - http://archives.neohapsis.com/archives/bugtraq/2014-06/0051.html - http://www.securitytracker.com/id/1030339 - http://www.securityfocu
s.neohapsis.com/archives/bugtraq/2014-06/0051.html - http://www.securitytracker.com/id/1030339 - http://www.securityfocus.com/archive/1/532596/100/0/threaded - http://packetstormsecurity.com/files/126960/EMC-Documentum-Content-Server-Escalation-Injection.html - http://secunia.com/advisories/58954
CVE ID: CVE-2014-2507 State: PUBLISHED Published: 2014-06-08T01:00:00 Last Updated: 2024-08-06T10:14:26.769Z Vendors: n/a Products: n/a Problem Types: n/a Description: EMC Documentum Content Server before 6.7 SP1 P28, 6.7 SP2 before P14, 7.0 before P15, and 7.1 before P05 allows remote authenticated users to execute arbitrary commands via shell metacharacters in arguments to unspecified methods. Additional Analyst Notes: - CVE Program Container: References: - http://archives.neohapsis.com/archives/bugtraq/2014-06/0051.html - http://www.securityfocus.com/bid/67916 - http://www.securitytracker.com/id/1030339 - http://www.securityfocus.com/archive/1/532596/100/0/threaded - http://packetstormsec
ww.securitytracker.com/id/1030339 - http://www.securityfocus.com/archive/1/532596/100/0/threaded - http://packetstormsecurity.com/files/126960/EMC-Documentum-Content-Server-Escalation-Injection.html - http://secunia.com/advisories/58954
CVE ID: CVE-2014-2508 State: PUBLISHED Published: 2014-06-08T01:00:00 Last Updated: 2024-08-06T10:14:26.562Z Vendors: n/a Products: n/a Problem Types: n/a Description: EMC Documentum Content Server before 6.7 SP1 P28, 6.7 SP2 before P14, 7.0 before P15, and 7.1 before P05 allows remote authenticated users to conduct Documentum Query Language (DQL) injection attacks and bypass intended restrictions on database actions via vectors involving DQL hints. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/67918 - http://archives.neohapsis.com/archives/bugtraq/2014-06/0051.html - http://www.securitytracker.com/id/1030339 - http://www.securityfocus.com/
apsis.com/archives/bugtraq/2014-06/0051.html - http://www.securitytracker.com/id/1030339 - http://www.securityfocus.com/archive/1/532596/100/0/threaded - http://packetstormsecurity.com/files/126960/EMC-Documentum-Content-Server-Escalation-Injection.html - http://secunia.com/advisories/58954
CVE ID: CVE-2014-2509 State: PUBLISHED Published: 2014-07-01T00:00:00 Last Updated: 2024-08-06T10:14:26.600Z Vendors: n/a Products: n/a Problem Types: n/a Description: Session fixation vulnerability in the Report Advisor (RA) component in EMC Network Configuration Manager (NCM) before 9.3 allows remote attackers to hijack web sessions via a session cookie. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/59423 - http://packetstormsecurity.com/files/127301/EMC-Network-Configuration-Manager-NCM-Session-Fixation.html - http://www.securitytracker.com/id/1030494 - http://archives.neohapsis.com/archives/bugtraq/2014-06/0168.html - http://www.securityfo
ecuritytracker.com/id/1030494 - http://archives.neohapsis.com/archives/bugtraq/2014-06/0168.html - http://www.securityfocus.com/archive/1/533077/100/0/threaded
CVE ID: CVE-2014-2510 State: PUBLISHED Published: 2014-07-08T10:00:00 Last Updated: 2024-08-06T10:14:26.557Z Vendors: n/a Products: n/a Problem Types: n/a Description: The JAXB XML parser in EMC Documentum Foundation Services (DFS) 6.6 before P39, 6.7 SP1 before P28, and 6.7 SP2 before P15, as used in My Documentum for Desktop, My Documentum for Microsoft Outlook, and CenterStage, allows remote authenticated users to read arbitrary files via an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/59773 - http://www.securityfocus.com/bid
yst Notes: - CVE Program Container: References: - http://secunia.com/advisories/59773 - http://www.securityfocus.com/bid/68434 - http://archives.neohapsis.com/archives/bugtraq/2014-07/0025.html - http://www.securitytracker.com/id/1030528
CVE ID: CVE-2014-2511 State: PUBLISHED Published: 2014-08-20T10:00:00 Last Updated: 2024-08-06T10:14:26.830Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in EMC Documentum WebTop before 6.7 SP1 P28 and 6.7 SP2 before P14 allow remote attackers to inject arbitrary web script or HTML via the (1) startat or (2) entryId parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/69272 - https://exchange.xforce.ibmcloud.com/vulnerabilities/95366 - http://www.securityfocus.com/archive/1/533160/30/0/threaded - http://secunia.com/advisories/60561 - http://www.securitytracker.com/id/1030
yfocus.com/archive/1/533160/30/0/threaded - http://secunia.com/advisories/60561 - http://www.securitytracker.com/id/1030741
CVE ID: CVE-2014-2512 State: PUBLISHED Published: 2014-07-01T00:00:00 Last Updated: 2024-08-06T10:14:26.656Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in EMC Documentum eRoom 7.4.3, 7.4.4 before P19, and 7.4.4 SP1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/127321/EMC-Documentum-eRoom-Stored-Cross-Site-Scripting.html - http://www.securitytracker.com/id/1030493 - http://secunia.com/advisories/59419 - http://packetstormsecurity.com/files/127309/EMC-Documentum-eRoom-Cross-Si
030493 - http://secunia.com/advisories/59419 - http://packetstormsecurity.com/files/127309/EMC-Documentum-eRoom-Cross-Site-Scripting.html - http://seclists.org/fulldisclosure/2014/Jul/0 - http://archives.neohapsis.com/archives/bugtraq/2014-06/0176.html - http://www.securityfocus.com/archive/1/532608/100/0/threaded
CVE ID: CVE-2014-2513 State: PUBLISHED Published: 2014-07-08T10:00:00 Last Updated: 2024-08-06T10:14:26.548Z Vendors: n/a Products: n/a Problem Types: n/a Description: EMC Documentum Content Server before 6.7 SP1 P28, 6.7 SP2 before P15, 7.0 before P15, and 7.1 before P06 does not properly check authorization after creation of an object, which allows remote authenticated users to execute arbitrary code with super-user privileges via a custom script. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1030529 - http://secunia.com/advisories/59757 - http://archives.neohapsis.com/archives/bugtraq/2014-07/0024.html - http://www.securityfocus.com/bid
m/advisories/59757 - http://archives.neohapsis.com/archives/bugtraq/2014-07/0024.html - http://www.securityfocus.com/bid/68435
CVE ID: CVE-2014-2514 State: PUBLISHED Published: 2014-07-08T10:00:00 Last Updated: 2024-08-06T10:14:26.651Z Vendors: n/a Products: n/a Problem Types: n/a Description: EMC Documentum Content Server before 6.7 SP1 P28, 6.7 SP2 before P15, 7.0 before P15, and 7.1 before P06 does not properly check authorization and does not properly restrict object types, which allows remote authenticated users to run save RPC commands with super-user privileges, and consequently execute arbitrary code, via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1030529 - http://secunia.com/advisories/59757 - http://www.securityfocus.com/bid/68436
http://www.securitytracker.com/id/1030529 - http://secunia.com/advisories/59757 - http://www.securityfocus.com/bid/68436 - http://archives.neohapsis.com/archives/bugtraq/2014-07/0024.html
CVE ID: CVE-2014-2515 State: PUBLISHED Published: 2014-08-20T10:00:00 Last Updated: 2024-08-06T10:14:26.603Z Vendors: n/a Products: n/a Problem Types: n/a Description: EMC Documentum D2 3.1 before P24, 3.1SP1 before P02, 4.0 before P11, 4.1 before P16, and 4.2 before P05 does not properly restrict tickets provided by D2GetAdminTicketMethod and D2RefreshCacheMethod, which allows remote authenticated users to gain privileges via a request for a superuser ticket. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/69275 - https://exchange.xforce.ibmcloud.com/vulnerabilities/95367 - http://secunia.com/advisories/60565 - http://www.securitytracker.com
xchange.xforce.ibmcloud.com/vulnerabilities/95367 - http://secunia.com/advisories/60565 - http://www.securitytracker.com/id/1030740 - http://www.securityfocus.com/archive/1/533161/30/0/threaded
CVE ID: CVE-2014-2516 State: PUBLISHED Published: 2014-12-12T18:00:00 Last Updated: 2024-08-06T10:14:26.717Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open redirect vulnerability in EMC RSA Authentication Manager 8.x before 8.1 Patch 6 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://archives.neohapsis.com/archives/bugtraq/2014-12/0074.html
CVE ID: CVE-2014-2517 State: PUBLISHED Published: 2014-08-20T10:00:00 Last Updated: 2024-08-06T10:14:26.596Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in EMC RSA Archer GRC Platform 5.x before 5.5 SP1 allows remote authenticated users to gain privileges via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/69287 - http://archives.neohapsis.com/archives/bugtraq/2014-08/0097.html - http://www.securitytracker.com/id/1030738 - https://exchange.xforce.ibmcloud.com/vulnerabilities/95363
CVE ID: CVE-2014-2518 State: PUBLISHED Published: 2014-08-20T10:00:00 Last Updated: 2024-08-06T10:14:26.572Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in EMC Documentum WDK before 6.7SP1 P28 and 6.7SP2 before P15 allow remote attackers to hijack the authentication of arbitrary users. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/60563 - http://www.securityfocus.com/bid/69277 - http://www.securityfocus.com/archive/1/533159/30/0/threaded - https://exchange.xforce.ibmcloud.com/vulnerabilities/95365 - http://www.securitytracker.com/id/1030742
CVE ID: CVE-2014-2519 State: PUBLISHED Published: 2014-07-19T19:00:00 Last Updated: 2024-08-06T10:14:26.575Z Vendors: n/a Products: n/a Problem Types: n/a Description: The default configuration of EMC RecoverPoint Appliance (RPA) 4.1 before 4.1.0.1 does not enable a firewall, which allows remote attackers to obtain potentially sensitive information about open ports, or cause a denial of service, by sending packets to many ports. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1030608 - http://archives.neohapsis.com/archives/bugtraq/2014-07/0091.html
CVE ID: CVE-2014-2520 State: PUBLISHED Published: 2014-08-20T10:00:00 Last Updated: 2024-08-06T10:14:26.572Z Vendors: n/a Products: n/a Problem Types: n/a Description: EMC Documentum Content Server before 6.7 SP2 P16 and 7.x before 7.1 P07, when Oracle Database is used, does not properly restrict DQL hints, which allows remote authenticated users to conduct DQL injection attacks and read sensitive database content via a crafted request. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1030743 - https://exchange.xforce.ibmcloud.com/vulnerabilities/95369 - http://www.securityfocus.com/archive/1/533162/30/0/threaded - http://secunia.com/advisori
ud.com/vulnerabilities/95369 - http://www.securityfocus.com/archive/1/533162/30/0/threaded - http://secunia.com/advisories/60571 - http://www.securityfocus.com/bid/69274
CVE ID: CVE-2014-2521 State: PUBLISHED Published: 2014-08-20T10:00:00 Last Updated: 2024-08-06T10:14:26.605Z Vendors: n/a Products: n/a Problem Types: n/a Description: EMC Documentum Content Server before 6.7 SP2 P16 and 7.x before 7.1 P07 allows remote authenticated users to read sensitive object metadata via an RPC command. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1030743 - http://www.securityfocus.com/bid/69276 - http://www.securityfocus.com/archive/1/533162/30/0/threaded - http://secunia.com/advisories/60571 - https://exchange.xforce.ibmcloud.com/vulnerabilities/95370
CVE ID: CVE-2014-2522 State: PUBLISHED Published: 2014-04-18T19:00:00 Last Updated: 2024-08-06T10:14:26.532Z Vendors: n/a Products: n/a Problem Types: n/a Description: curl and libcurl 7.27.0 through 7.35.0, when running on Windows and using the SChannel/Winssl TLS backend, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate when accessing a URL that uses a numerical IP address, which allows man-in-the-middle attackers to spoof servers via an arbitrary valid certificate. Additional Analyst Notes: - CVE Program Container: References: - http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MI
Analyst Notes: - CVE Program Container: References: - http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095862 - http://secunia.com/advisories/57836 - http://www.securityfocus.com/bid/66296 - http://www.getchef.com/blog/2014/04/09/chef-server-11-0-12-release/ - http://secunia.com/advisories/59458 - http://seclists.org/oss-sec/2014/q1/586 - http://secunia.com/advisories/57968 - http://seclists.org/oss-sec/2014/q1/585 - http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/ - http://curl.haxx.se/docs/adv_20140326D.html - http://www.getchef.com/blog/2014/04/09/enterprise-chef-1-4-9-release/ - http://secunia.com/advisories/57966