Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2014-2523 State: PUBLISHED Published: 2014-03-24T10:00:00 Last Updated: 2024-08-06T10:14:26.656Z Vendors: n/a Products: n/a Problem Types: n/a Description: net/netfilter/nf_conntrack_proto_dccp.c in the Linux kernel through 3.13.6 uses a DCCP header pointer incorrectly, which allows remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a DCCP packet that triggers a call to the (1) dccp_new, (2) dccp_packet, or (3) dccp_error function. Additional Analyst Notes: - CVE Program Container: References: - http://twitter.com/grsecurity/statuses/445496197399461888 - http://www.ubuntu.com/usn/USN-2173-1 - http://www.securityfocus.com/bid/66279
/grsecurity/statuses/445496197399461888 - http://www.ubuntu.com/usn/USN-2173-1 - http://www.securityfocus.com/bid/66279 - http://www.ubuntu.com/usn/USN-2174-1 - http://secunia.com/advisories/57446 - https://bugzilla.redhat.com/show_bug.cgi?id=1077343 - http://www.securitytracker.com/id/1029945 - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=b22f5126a24b3b2f15448c3f2a254fc10cbc2b92 - https://exchange.xforce.ibmcloud.com/vulnerabilities/91910 - https://github.com/torvalds/linux/commit/b22f5126a24b3b2f15448c3f2a254fc10cbc2b92 - http://www.openwall.com/lists/oss-security/2014/03/17/7
CVE ID: CVE-2014-2524 State: PUBLISHED Published: 2014-08-20T14:00:00 Last Updated: 2024-08-06T10:14:26.704Z Vendors: n/a Products: n/a Problem Types: n/a Description: The _rl_tropen function in util.c in GNU readline before 6.3 patch 3 allows local users to create or overwrite arbitrary files via a symlink attack on a /var/tmp/rltrace.[PID] file. Additional Analyst Notes: - CVE Program Container: References: - http://www.mandriva.com/security/advisories?name=MDVSA-2014:154 - http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00037.html - https://bugzilla.redhat.com/show_bug.cgi?id=1077023 - https://lists.fedoraproject.org/pipermail/package-announce/2014-July/135686.html - http:
t.com/show_bug.cgi?id=1077023 - https://lists.fedoraproject.org/pipermail/package-announce/2014-July/135686.html - http://seclists.org/oss-sec/2014/q1/587 - http://www.mandriva.com/security/advisories?name=MDVSA-2015:132 - http://advisories.mageia.org/MGASA-2014-0319.html - http://lists.gnu.org/archive/html/bug-readline/2014-03/msg00057.html - http://seclists.org/oss-sec/2014/q1/579
CVE ID: CVE-2014-2525 State: PUBLISHED Published: 2014-03-28T15:00:00 Last Updated: 2024-08-06T10:14:26.613Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in the yaml_parser_scan_uri_escapes function in LibYAML before 0.1.6 allows context-dependent attackers to execute arbitrary code via a long sequence of percent-encoded characters in a URI in a YAML file. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/66478 - http://secunia.com/advisories/57836 - https://puppet.com/security/cve/cve-2014-2525 - http://www.mandriva.com/security/advisories?name=MDVSA-2015:060 - http://www.ocert.org/advisories/ocert-2014
2014-2525 - http://www.mandriva.com/security/advisories?name=MDVSA-2015:060 - http://www.ocert.org/advisories/ocert-2014-003.html - http://www.debian.org/security/2014/dsa-2885 - http://www.ubuntu.com/usn/USN-2160-1 - http://lists.opensuse.org/opensuse-updates/2015-02/msg00078.html - http://rhn.redhat.com/errata/RHSA-2014-0355.html - http://www.debian.org/security/2014/dsa-2884 - http://rhn.redhat.com/errata/RHSA-2014-0354.html - http://www.getchef.com/blog/2014/04/09/chef-server-11-0-12-release/ - https://bitbucket.org/xi/libyaml/commits/bce8b60f0b9af69fa9fab3093d0a41ba243de048 - http://advisories.mageia.org/MGASA-2014-0150.html - http://lists.opensuse.org/opensuse-updates/2014-04/msg00022.
de048 - http://advisories.mageia.org/MGASA-2014-0150.html - http://lists.opensuse.org/opensuse-updates/2014-04/msg00022.html - http://support.apple.com/kb/HT6443 - http://lists.opensuse.org/opensuse-updates/2016-04/msg00050.html - http://rhn.redhat.com/errata/RHSA-2014-0353.html - http://secunia.com/advisories/57968 - http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/ - http://www.getchef.com/blog/2014/04/09/enterprise-chef-1-4-9-release/ - http://secunia.com/advisories/57966
CVE ID: CVE-2014-2526 State: PUBLISHED Published: 2014-03-25T14:00:00 Last Updated: 2024-08-06T10:14:26.567Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in BarracudaDrive before 6.7 allow remote attackers to inject arbitrary web script or HTML via the (1) sForumName or (2) sDescription parameter to Forum/manage/ForumManager.lsp; (3) sHint, (4) sWord, or (5) nId parameter to Forum/manage/hangman.lsp; (6) user parameter to rtl/protected/admin/wizard/setuser.lsp; (7) name or (8) email parameter to feedback.lsp; (9) lname or (10) url parameter to private/manage/PageManager.lsp; (11) cmd parameter to fs; (12) newname, (13) descrip
(9) lname or (10) url parameter to private/manage/PageManager.lsp; (11) cmd parameter to fs; (12) newname, (13) description, (14) firstname, (15) lastname, or (16) id parameter to rtl/protected/mail/manage/list.lsp; or (17) PATH_INFO to fs/. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/57451 - http://secpod.org/blog/?p=2158 - https://exchange.xforce.ibmcloud.com/vulnerabilities/91920 - http://packetstormsecurity.com/files/125766 - http://secpod.org/advisories/SecPod_BarracudaDrive_Mult_XSS_Vuln.txt - http://barracudadrive.com/readme.txt - http://www.securityfocus.com/bid/66269
CVE ID: CVE-2014-2527 State: PUBLISHED Published: 2014-08-26T14:00:00 Last Updated: 2024-08-06T10:14:26.555Z Vendors: n/a Products: n/a Problem Types: n/a Description: kcleanup.cpp in KDirStat 2.7.0 does not properly quote strings when deleting a directory, which allows remote attackers to execute arbitrary commands via a " (double quote) character in the directory name, a different vulnerability than CVE-2014-2528. Additional Analyst Notes: - CVE Program Container: References: - https://bitbucket.org/jeromerobert/k4dirstat/commits/1ad2e96d73fa06cd9be0f3749b337c03575016aa#chg-src/kcleanup.cpp - http://lists.opensuse.org/opensuse-updates/2014-08/msg00015.html - https://bugzilla.redhat.com/sho
hg-src/kcleanup.cpp - http://lists.opensuse.org/opensuse-updates/2014-08/msg00015.html - https://bugzilla.redhat.com/show_bug.cgi?id=1077059 - http://www.openwall.com/lists/oss-security/2014/03/17/2 - http://www.openwall.com/lists/oss-security/2014/03/18/2 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=741659
CVE ID: CVE-2014-2528 State: PUBLISHED Published: 2014-08-26T14:00:00 Last Updated: 2024-08-06T10:14:26.607Z Vendors: n/a Products: n/a Problem Types: n/a Description: kcleanup.cpp in KDirStat 2.7.3 does not properly quote strings when deleting a directory, which allows remote attackers to execute arbitrary commands via a ' (single quote) character in the directory name, a different vulnerability than CVE-2014-2527. Additional Analyst Notes: - CVE Program Container: References: - https://bitbucket.org/jeromerobert/k4dirstat/commits/1ad2e96d73fa06cd9be0f3749b337c03575016aa#chg-src/kcleanup.cpp - http://lists.opensuse.org/opensuse-updates/2014-08/msg00015.html - http://www.openwall.com/lists/o
hg-src/kcleanup.cpp - http://lists.opensuse.org/opensuse-updates/2014-08/msg00015.html - http://www.openwall.com/lists/oss-security/2014/03/17/2 - http://www.openwall.com/lists/oss-security/2014/03/18/2 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=741659
CVE ID: CVE-2014-2531 State: PUBLISHED Published: 2014-10-21T16:00:00 Last Updated: 2024-08-06T10:14:26.579Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in xhr.php in InterWorx Web Control Panel (aka InterWorx Hosting Control Panel and InterWorx-CP) before 5.0.14 build 577 allows remote authenticated users to execute arbitrary SQL commands via the i parameter in a search action to the (1) NodeWorx , (2) SiteWorx, or (3) Resellers interface, as demonstrated by the "or" key in a pgn8state object in an i object in a JSON object. Additional Analyst Notes: - CVE Program Container: References: - http://forums.interworx.com/threads/8000-InterWorx-Version-5
ional Analyst Notes: - CVE Program Container: References: - http://forums.interworx.com/threads/8000-InterWorx-Version-5-0-14-Released-on-Beta-Channel%21 - http://www.exploit-db.com/exploits/32516 - http://www.securityfocus.com/archive/1/531601/100/0/threaded
CVE ID: CVE-2014-2532 State: PUBLISHED Published: 2014-03-18T01:00:00 Last Updated: 2024-08-06T10:14:26.611Z Vendors: n/a Products: n/a Problem Types: n/a Description: sshd in OpenSSH before 6.6 does not properly support wildcards on AcceptEnv lines in sshd_config, which allows remote attackers to bypass intended environment restrictions by using a substring located before a wildcard character. Additional Analyst Notes: - CVE Program Container: References: - http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html - http://secunia.com/advisories/59855 - http://secunia.com/advisories/57574 - http://advisories.mageia.org/MGASA-2014-0143.html - http://lists.apple.com/archives
ttp://secunia.com/advisories/57574 - http://advisories.mageia.org/MGASA-2014-0143.html - http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html - http://marc.info/?l=bugtraq&m=141576985122836&w=2 - http://marc.info/?l=bugtraq&m=141576985122836&w=2 - http://secunia.com/advisories/57488 - http://www.mandriva.com/security/advisories?name=MDVSA-2015:095 - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html - http://secunia.com/advisories/59313 - https://support.apple.com/HT205267 - http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133537.html - http://www.debian.org/security/2014/dsa-2894 - http://rhn.redhat.com/errata/RHSA-2014-1552.htm
ce/2014-May/133537.html - http://www.debian.org/security/2014/dsa-2894 - http://rhn.redhat.com/errata/RHSA-2014-1552.html - http://aix.software.ibm.com/aix/efixes/security/openssh_advisory4.asc - http://www.securitytracker.com/id/1029925 - http://marc.info/?l=openbsd-security-announce&m=139492048027313&w=2 - http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html - http://www.ubuntu.com/usn/USN-2155-1 - http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134026.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/91986 - http://www.mandriva.com/security/advisories?name=MDVSA-2014:068 - http://www.securityfocus.com/bid/66355
CVE ID: CVE-2014-2533 State: PUBLISHED Published: 2014-03-18T01:00:00 Last Updated: 2024-08-06T10:14:26.825Z Vendors: n/a Products: n/a Problem Types: n/a Description: /sbin/ifwatchd in BlackBerry QNX Neutrino RTOS 6.4.x and 6.5.x allows local users to gain privileges by providing an arbitrary program name as a command-line argument. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2014/Mar/124 - https://www.exploit-db.com/exploits/45575/ - http://seclists.org/bugtraq/2014/Mar/66 - http://seclists.org/fulldisclosure/2014/Mar/98 - http://seclists.org/bugtraq/2014/Mar/88 - http://www.exploit-db.com/exploits/32153/
CVE ID: CVE-2014-2534 State: PUBLISHED Published: 2014-03-18T01:00:00 Last Updated: 2024-08-06T10:14:26.718Z Vendors: n/a Products: n/a Problem Types: n/a Description: /sbin/pppoectl in BlackBerry QNX Neutrino RTOS 6.4.x and 6.5.x allows local users to obtain sensitive information by reading "bad parameter" lines in error messages, as demonstrated by reading the root password hash in /etc/shadow. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/32156/ - http://seclists.org/fulldisclosure/2014/Mar/124 - http://seclists.org/bugtraq/2014/Mar/66 - http://seclists.org/fulldisclosure/2014/Mar/98 - http://seclists.org/bugtraq/2014/Mar/88
CVE ID: CVE-2014-2535 State: PUBLISHED Published: 2014-03-18T14:00:00 Last Updated: 2024-08-06T10:14:26.739Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in McAfee Web Gateway (MWG) 7.4.x before 7.4.1, 7.3.x before 7.3.2.6, and 7.2.0.9 and earlier allows remote authenticated users to read arbitrary files via a crafted request to the web filtering port. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/56958 - http://www.securityfocus.com/bid/66193 - https://kc.mcafee.com/corporate/index?page=content&id=SB10063 - https://exchange.xforce.ibmcloud.com/vulnerabilities/91772
CVE ID: CVE-2014-2536 State: PUBLISHED Published: 2014-03-18T14:00:00 Last Updated: 2024-08-06T10:14:26.579Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in McAfee Cloud Identity Manager 3.0, 3.1, and 3.5.1, McAfee Cloud Single Sign On (MCSSO) before 4.0.1, and Intel Expressway Cloud Access 360-SSO 2.1 and 2.5 allows remote authenticated users to read an unspecified file containing a hash of the administrator password via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/66181 - http://secunia.com/advisories/57381 - http://secunia.com/advisories/57368 - https://kc.mcafee.com/corpo
.com/bid/66181 - http://secunia.com/advisories/57381 - http://secunia.com/advisories/57368 - https://kc.mcafee.com/corporate/index?page=content&id=SB10066
CVE ID: CVE-2014-2537 State: PUBLISHED Published: 2014-03-18T14:00:00 Last Updated: 2024-08-06T10:14:26.610Z Vendors: n/a Products: n/a Problem Types: n/a Description: Memory leak in the TCP stack in the kernel in Sophos UTM before 9.109 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1029920 - http://secunia.com/advisories/57344 - http://blogs.sophos.com/2014/02/20/utm-up2date-9-109/ - http://www.securityfocus.com/bid/66231
CVE ID: CVE-2014-2538 State: PUBLISHED Published: 2014-03-25T14:00:00 Last Updated: 2024-08-06T10:14:26.818Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in lib/rack/ssl.rb in the rack-ssl gem before 1.4.0 for Ruby allows remote attackers to inject arbitrary web script or HTML via a URI, which might not be properly handled by third-party adapters such as JRuby-Rack. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2014/03/19/20 - https://github.com/josh/rack-ssl/commit/9d7d7300b907e496db68d89d07fbc2e0df0b487b - http://www.securityfocus.com/bid/66314 - http://lists.opensuse.org/op
/commit/9d7d7300b907e496db68d89d07fbc2e0df0b487b - http://www.securityfocus.com/bid/66314 - http://lists.opensuse.org/opensuse-updates/2014-04/msg00032.html - http://secunia.com/advisories/57466
CVE ID: CVE-2014-2540 State: PUBLISHED Published: 2014-04-11T14:00:00 Last Updated: 2024-08-06T10:14:26.693Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in OrbitScripts Orbit Open Ad Server before 1.1.1 allows remote attackers to execute arbitrary SQL commands via the site_directory_sort_field parameter to guest/site_directory. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/531781/100/0/threaded - https://www.htbridge.com/advisory/HTB23208 - http://www.securityfocus.com/bid/66667 - http://www.exploit-db.com/exploits/32792
CVE ID: CVE-2014-2541 State: PUBLISHED Published: 2014-04-08T17:00:00 Last Updated: 2024-08-06T10:14:26.650Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Rendezvous Daemon (rvd), Rendezvous Routing Daemon (rvrd), Rendezvous Secure Daemon (rvsd), and Rendezvous Secure Routing Daemon (rvsrd) in TIBCO Rendezvous before 8.4.2, Messaging Appliance before 8.7.1, and Substation ES before 2.8.1 do not properly implement access control, which allows remote attackers to obtain sensitive information or modify transmitted information via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.tibco.com/multimedia/rendezvous_advisory_20140408_tcm
l Analyst Notes: - CVE Program Container: References: - http://www.tibco.com/multimedia/rendezvous_advisory_20140408_tcm8-20763.txt - http://www.tibco.com/mk/advisory.jsp - http://www.securitytracker.com/id/1030070
CVE ID: CVE-2014-2542 State: PUBLISHED Published: 2014-04-08T17:00:00 Last Updated: 2024-08-06T10:14:26.653Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Rendezvous Daemon (rvd), Rendezvous Routing Daemon (rvrd), Rendezvous Secure Daemon (rvsd), and Rendezvous Secure Routing Daemon (rvsrd) in TIBCO Rendezvous before 8.4.2, Messaging Appliance before 8.7.1, and Substation ES before 2.8.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/66737 - http://www.tibco.com/multimedia/rendezvous_advisory_20
Container: References: - http://www.securityfocus.com/bid/66737 - http://www.tibco.com/multimedia/rendezvous_advisory_20140408_tcm8-20763.txt - http://www.tibco.com/mk/advisory.jsp - http://www.securitytracker.com/id/1030070 - http://www.securityfocus.com/bid/101873
CVE ID: CVE-2014-2543 State: PUBLISHED Published: 2014-04-08T17:00:00 Last Updated: 2024-08-06T10:21:35.966Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the Rendezvous Daemon (rvd), Rendezvous Routing Daemon (rvrd), Rendezvous Secure Daemon (rvsd), and Rendezvous Secure Routing Daemon (rvsrd) in TIBCO Rendezvous before 8.4.2, Messaging Appliance before 8.7.1, and Substation ES before 2.8.1 allows remote attackers to execute arbitrary code by leveraging access to a directly connected client and transmitting crafted data. Additional Analyst Notes: - CVE Program Container: References: - http://www.tibco.com/multimedia/rendezvous_advisory_20140408_tcm8-20763.txt
otes: - CVE Program Container: References: - http://www.tibco.com/multimedia/rendezvous_advisory_20140408_tcm8-20763.txt - http://www.securityfocus.com/bid/66744 - http://www.tibco.com/mk/advisory.jsp - http://www.securitytracker.com/id/1030070
CVE ID: CVE-2014-2544 State: PUBLISHED Published: 2014-04-09T23:00:00 Last Updated: 2024-08-06T10:21:35.804Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in Spotfire Web Player Engine, Spotfire Desktop, and Spotfire Server Authentication Module in TIBCO Spotfire Server 3.3.x before 3.3.4, 4.5.x before 4.5.1, 5.0.x before 5.0.2, 5.5.x before 5.5.1, and 6.x before 6.0.2; Spotfire Professional 4.0.x before 4.0.4, 4.5.x before 4.5.2, 5.0.x before 5.0.2, 5.5.x before 5.5.1, and 6.x before 6.0.1; Spotfire Web Player 4.0.x before 4.0.4, 4.5.x before 4.5.2, 5.0.x before 5.0.2, 5.5.x before 5.5.1, and 6.x before 6.0.1; Spotfire Automation Services 4.0.x before
x before 4.5.2, 5.0.x before 5.0.2, 5.5.x before 5.5.1, and 6.x before 6.0.1; Spotfire Automation Services 4.0.x before 4.0.4, 4.5.x before 4.5.2, 5.0.x before 5.0.2, 5.5.x before 5.5.1, and 6.x before 6.0.1; Spotfire Deployment Kit 4.0.x before 4.0.4, 4.5.x before 4.5.2, 5.0.x before 5.0.2, 5.5.x before 5.5.1, and 6.x before 6.0.1; Spotfire Desktop 6.x before 6.0.1; and Spotfire Analyst 6.x before 6.0.1 allows remote attackers to execute arbitrary code via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.tibco.com/mk/advisory.jsp - http://www.tibco.com/multimedia/spotfire_advisory_20140409_tcm8-20764.txt
CVE ID: CVE-2014-2545 State: PUBLISHED Published: 2014-04-30T10:00:00 Last Updated: 2024-08-06T10:21:35.251Z Vendors: n/a Products: n/a Problem Types: n/a Description: TIBCO Managed File Transfer Internet Server before 7.2.2, Managed File Transfer Command Center before 7.2.2, Slingshot before 1.9.1, and Vault before 1.0.1 allow remote attackers to obtain sensitive information via a crafted HTTP request. Additional Analyst Notes: - CVE Program Container: References: - http://www.tibco.com/multimedia/mft_advisory_20140429_tcm8-21013.txt - http://www.tibco.com/mk/advisory.jsp
CVE ID: CVE-2014-2550 State: PUBLISHED Published: 2018-03-19T21:00:00 Last Updated: 2024-08-06T10:21:34.677Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in the Disable Comments plugin before 1.0.4 for WordPress allows remote attackers to hijack the authentication of administrators for requests that enable comments via a request to the disable_comments_settings page to wp-admin/options-general.php. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/92219 - https://security.dxw.com/advisories/csrf-in-disable-comments-1-0-3/ - https://wordpress.org/plugins/disable-co
s/92219 - https://security.dxw.com/advisories/csrf-in-disable-comments-1-0-3/ - https://wordpress.org/plugins/disable-comments/#developers
CVE ID: CVE-2014-2552 State: PUBLISHED Published: 2018-04-27T16:00:00 Last Updated: 2024-08-06T10:21:34.625Z Vendors: n/a Products: n/a Problem Types: n/a Description: Brookins Consulting (BC) Collected Information Export extension for eZ Publish 1.1.0 does not properly restrict access, which allows remote attackers to gain access to sensitive data. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/brookinsconsulting/bccie/commit/d11811baccf265ff567dddca03cac70b65838a4f - https://exchange.xforce.ibmcloud.com/vulnerabilities/92129 - https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2014-004/?fid=3853
CVE ID: CVE-2014-2553 State: PUBLISHED Published: 2014-04-02T14:00:00 Last Updated: 2024-08-06T10:21:35.697Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.1.x before 3.1.21, 3.2.x before 3.2.16, and 3.3.x before 3.3.6 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to dynamic fields. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/57616 - https://www.otrs.com/security-advisory-2014-04-xss-issue - http://lists.opensuse.org/opensuse-updates/2014-04/msg00062.html
CVE ID: CVE-2014-2554 State: PUBLISHED Published: 2014-04-23T14:00:00 Last Updated: 2024-08-06T10:21:34.657Z Vendors: n/a Products: n/a Problem Types: n/a Description: OTRS 3.1.x before 3.1.21, 3.2.x before 3.2.16, and 3.3.x before 3.3.6 allows remote attackers to conduct clickjacking attacks via an IFRAME element. Additional Analyst Notes: - CVE Program Container: References: - http://www.otrs.com/security-advisory-2014-05-clickjacking-issue/ - http://lists.opensuse.org/opensuse-updates/2014-04/msg00062.html
CVE ID: CVE-2014-2558 State: PUBLISHED Published: 2014-05-06T14:00:00 Last Updated: 2024-08-06T10:21:34.678Z Vendors: n/a Products: n/a Problem Types: n/a Description: The File Gallery plugin before 1.7.9.2 for WordPress does not properly escape strings, which allows remote administrators to execute arbitrary PHP code via a \' (backslash quote) in the setting fields to /wp-admin/options-media.php, related to the create_function function. Additional Analyst Notes: - CVE Program Container: References: - http://wordpress.org/plugins/file-gallery/changelog/ - http://www.securityfocus.com/bid/67120 - http://seclists.org/fulldisclosure/2014/Apr/305 - http://www.securityfocus.com/bid/67183