Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2014-3224 State: PUBLISHED Published: 2017-04-02T20:00:00 Last Updated: 2024-08-06T10:35:57.066Z Vendors: n/a Products: Quidway S9700,Quidway S9300,Quidway S7700,Quidway S6700,Quidway S6300,Quidway S5700,Quidway S5300 Quidway S9700 V200R003C00SPC500,Quidway S9300 V200R003C00SPC500,Quidway S7700 V200R003C00SPC500,Quidway S6700 V200R003C00SPC300,Quidway S6300 V200R003C00SPC300,Quidway S5700 V200R003C00SPC300,Quidway S5300 V200R003C00SPC300 Problem Types: Improper Input Validation Description: Huawei Quidway S9700 V200R003C00SPC500, Quidway S9300 V200R003C00SPC500, Quidway S7700 V200R003C00SPC500, Quidway S6700 V200R003C00SPC300, Quidway S6300 V200R003C00SPC300, Quidway S5700 V200R0
Quidway S7700 V200R003C00SPC500, Quidway S6700 V200R003C00SPC300, Quidway S6300 V200R003C00SPC300, Quidway S5700 V200R003C00SPC300, Quidway S5300 V200R003C00SPC300 enable attackers to launch DoS attacks by crafting and sending malformed packets to these vulnerable products. Additional Analyst Notes: - CVE Program Container: References: - http://www.huawei.com/en/psirt/security-advisories/hw-333184
CVE ID: CVE-2014-3225 State: PUBLISHED Published: 2014-05-14T00:00:00 Last Updated: 2024-08-06T10:35:57.073Z Vendors: n/a Products: n/a Problem Types: n/a Description: Absolute path traversal vulnerability in the web interface in Cobbler 2.4.x through 2.6.x allows remote authenticated users to read arbitrary files via the Kickstart field in a profile. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/oss-sec/2014/q2/274 - https://github.com/cobbler/cobbler/issues/939 - http://www.osvdb.org/106759 - http://www.securityfocus.com/bid/67277 - http://seclists.org/oss-sec/2014/q2/273 - https://www.youtube.com/watch?v=vuBaoQUFEYQ&feature=youtu.be - http://packetst
http://seclists.org/oss-sec/2014/q2/273 - https://www.youtube.com/watch?v=vuBaoQUFEYQ&feature=youtu.be - http://packetstormsecurity.com/files/126553/Cobbler-Local-File-Inclusion.html - http://www.securityfocus.com/archive/1/532094/100/0/threaded - http://www.exploit-db.com/exploits/33252
CVE ID: CVE-2014-3227 State: PUBLISHED Published: 2014-05-30T18:00:00 Last Updated: 2024-08-06T10:35:57.130Z Vendors: n/a Products: n/a Problem Types: n/a Description: dpkg 1.15.9, 1.16.x before 1.16.14, and 1.17.x before 1.17.9 expect the patch program to be compliant with a need for the "C-style encoded filenames" feature, but is supported in environments with noncompliant patch programs, which triggers an interaction error that allows remote attackers to conduct directory traversal attacks and modify files outside of the intended directories via a crafted source package. NOTE: this vulnerability exists because of reliance on unrealistic constraints on the behavior of an external program.
NOTE: this vulnerability exists because of reliance on unrealistic constraints on the behavior of an external program. Additional Analyst Notes: - CVE Program Container: References: - http://openwall.com/lists/oss-security/2014/05/29/16 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=746306 - http://openwall.com/lists/oss-security/2014/04/29/4
CVE ID: CVE-2014-3230 State: PUBLISHED Published: 2020-01-28T15:05:37 Last Updated: 2024-08-06T10:35:57.043Z Vendors: libwww-perl Products: LWP::Protocol::https Problem Types: Other Description: The libwww-perl LWP::Protocol::https module 6.04 through 6.06 for Perl, when using IO::Socket::SSL as the SSL socket class, allows attackers to disable server certificate validation via the (1) HTTPS_CA_DIR or (2) HTTPS_CA_FILE environment variable. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=746579 - https://github.com/libwww-perl/lwp-protocol-https/pull/14 - http://www.openwall.com/lists/oss-security/2014/05/02/8 - http://www.op
hub.com/libwww-perl/lwp-protocol-https/pull/14 - http://www.openwall.com/lists/oss-security/2014/05/02/8 - http://www.openwall.com/lists/oss-security/2014/05/04/1 - http://www.openwall.com/lists/oss-security/2014/05/06/8
CVE ID: CVE-2014-3242 State: PUBLISHED Published: 2014-05-12T14:00:00 Last Updated: 2024-08-06T10:35:57.076Z Vendors: n/a Products: n/a Problem Types: n/a Description: SOAPpy 0.12.5 allows remote attackers to read arbitrary files via a SOAP request containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2014/May/20 - http://www.openwall.com/lists/oss-security/2014/05/06/1 - http://www.pnigos.com/?p=260 - http://www.securityfocus.com/bid/67216 - http://www.openwall.com/lists/oss-security/2014/05/06/9
CVE ID: CVE-2014-3243 State: PUBLISHED Published: 2014-05-12T14:00:00 Last Updated: 2024-08-06T10:35:57.153Z Vendors: n/a Products: n/a Problem Types: n/a Description: SOAPpy 0.12.5 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted SOAP request containing a large number of nested entity references. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2014/May/20 - http://www.openwall.com/lists/oss-security/2014/05/06/1 - http://www.pnigos.com/?p=260 - http://www.securityfocus.com/bid/67216 - http://www.openwall.com/lists/oss-security/2
1 - http://www.pnigos.com/?p=260 - http://www.securityfocus.com/bid/67216 - http://www.openwall.com/lists/oss-security/2014/05/06/9
CVE ID: CVE-2014-3244 State: PUBLISHED Published: 2018-02-01T17:00:00 Last Updated: 2024-08-06T10:35:57.081Z Vendors: n/a Products: n/a Problem Types: n/a Description: XML external entity (XXE) vulnerability in the RSSDashlet dashlet in SugarCRM before 6.5.17 allows remote attackers to read arbitrary files or potentially execute arbitrary code via a crafted DTD in an XML request. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/68102 - https://web.archive.org/web/20151105182132/http://www.pnigos.com/?p=294 - http://seclists.org/fulldisclosure/2014/Jun/92
CVE ID: CVE-2014-3246 State: PUBLISHED Published: 2014-05-13T14:00:00 Last Updated: 2024-08-06T10:35:57.082Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Collabtive 1.2 allows remote authenticated users to execute arbitrary SQL commands via the folder parameter in a fileview_list action to manageajax.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/33249 - http://www.securityfocus.com/bid/67287
CVE ID: CVE-2014-3247 State: PUBLISHED Published: 2014-05-15T14:00:00 Last Updated: 2024-08-06T10:35:57.082Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Collabtive 1.2 allows remote authenticated users to inject arbitrary web script or HTML via the desc parameter in an Add project (addpro) action to admin.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/67343 - http://www.exploit-db.com/exploits/33250
CVE ID: CVE-2014-3248 State: PUBLISHED Published: 2014-11-16T17:00:00 Last Updated: 2024-08-06T10:35:57.167Z Vendors: n/a Products: n/a Problem Types: n/a Description: Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before 1.3.4, and Mcollective before 2.5.2, when running with Ruby 1.9.1 or earlier, allows local users to gain privileges via a Trojan horse file in the current working directory, as demonstrated using (1) rubygems/defaults/operating_system.rb, (2) Win32API.rb, (3) Win32API.so, (4) safe_yaml.rb, (5) safe_yaml/deep.rb, or (6) safe_yaml/deep.so; or (7) operatingsystem.rb,
32API.rb, (3) Win32API.so, (4) safe_yaml.rb, (5) safe_yaml/deep.rb, or (6) safe_yaml/deep.so; or (7) operatingsystem.rb, (8) operatingsystem.so, (9) osfamily.rb, or (10) osfamily.so in puppet/confine. Additional Analyst Notes: - CVE Program Container: References: - http://puppetlabs.com/security/cve/cve-2014-3248 - http://secunia.com/advisories/59197 - http://secunia.com/advisories/59200 - http://rowediness.com/2014/06/13/cve-2014-3248-a-little-problem-with-puppet/ - http://www.securityfocus.com/bid/68035
CVE ID: CVE-2014-3249 State: PUBLISHED Published: 2014-06-17T14:00:00 Last Updated: 2024-08-06T10:35:57.139Z Vendors: n/a Products: n/a Problem Types: n/a Description: Puppet Enterprise 2.8.x before 2.8.7 allows remote attackers to obtain sensitive information via vectors involving hiding and unhiding nodes. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/59197 - http://puppetlabs.com/security/cve/cve-2014-3249
CVE ID: CVE-2014-3250 State: PUBLISHED Published: 2017-12-11T17:00:00 Last Updated: 2024-08-06T10:35:57.093Z Vendors: n/a Products: n/a Problem Types: n/a Description: The default vhost configuration file in Puppet before 3.6.2 does not include the SSLCARevocationCheck directive, which might allow remote attackers to obtain sensitive information via a revoked certificate when a Puppet master runs with Apache 2.4. Additional Analyst Notes: - CVE Program Container: References: - https://puppet.com/security/cve/CVE-2014-3250 - https://bugzilla.redhat.com/show_bug.cgi?id=1101347
CVE ID: CVE-2014-3251 State: PUBLISHED Published: 2014-08-12T23:00:00 Last Updated: 2024-08-06T10:35:57.093Z Vendors: n/a Products: n/a Problem Types: n/a Description: The MCollective aes_security plugin, as used in Puppet Enterprise before 3.3.0 and Mcollective before 2.5.3, does not properly validate new server certificates based on the CA certificate, which allows local users to establish unauthorized Mcollective connections via unspecified vectors related to a race condition. Additional Analyst Notes: - CVE Program Container: References: - http://www.osvdb.org/109257 - http://puppetlabs.com/security/cve/cve-2014-3251 - http://secunia.com/advisories/60066 - http://secunia.com/advisories/5
http://puppetlabs.com/security/cve/cve-2014-3251 - http://secunia.com/advisories/60066 - http://secunia.com/advisories/59356
CVE ID: CVE-2014-3260 State: PUBLISHED Published: 2015-12-31T02:00:00 Last Updated: 2024-08-06T10:35:57.085Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pacom 1000 CCU and RTU GMS devices allow remote attackers to spoof the controller-to-base data stream by leveraging improper use of cryptography. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-15-337-03
CVE ID: CVE-2014-3261 State: PUBLISHED Published: 2014-05-24T01:00:00 Last Updated: 2024-08-06T10:35:57.142Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the Smart Call Home implementation in Cisco NX-OS on Fabric Interconnects in Cisco Unified Computing System 1.4 before 1.4(1i), NX-OS 5.0 before 5.0(3)U2(2) on Nexus 3000 devices, NX-OS 4.1 before 4.1(2)E1(1l) on Nexus 4000 devices, NX-OS 5.x before 5.1(3)N1(1) on Nexus 5000 devices, NX-OS 5.2 before 5.2(3a) on Nexus 7000 devices, and CG-OS CG4 before CG4(2) on Connected 1000 Connected Grid Routers allows remote SMTP servers to execute arbitrary code via a crafted reply, aka Bug IDs CSCtk00695, CSCts56633, C
Routers allows remote SMTP servers to execute arbitrary code via a crafted reply, aka Bug IDs CSCtk00695, CSCts56633, CSCts56632, CSCts56628, CSCug14405, and CSCuf61322. Additional Analyst Notes: - CVE Program Container: References: - http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140521-nxos
CVE ID: CVE-2014-3262 State: PUBLISHED Published: 2014-05-16T10:00:00 Last Updated: 2024-08-06T10:35:57.053Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Locator/ID Separation Protocol (LISP) implementation in Cisco IOS 15.3(3)S and earlier and IOS XE does not properly validate parameters in ITR control messages, which allows remote attackers to cause a denial of service (CEF outage and packet drops) via malformed messages, aka Bug ID CSCun73782. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1030243 - http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3262 - http://tools.cisco.com/security/center/
tp://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3262 - http://tools.cisco.com/security/center/viewAlert.x?alertId=34233
CVE ID: CVE-2014-3263 State: PUBLISHED Published: 2014-05-16T10:00:00 Last Updated: 2024-08-06T10:35:57.141Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ScanSafe module in Cisco IOS 15.3(3)M allows remote attackers to cause a denial of service (device reload) via HTTPS packets that require tower processing, aka Bug ID CSCum97038. Additional Analyst Notes: - CVE Program Container: References: - http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3263 - http://www.securitytracker.com/id/1030244 - http://tools.cisco.com/security/center/viewAlert.x?alertId=34234
CVE ID: CVE-2014-3264 State: PUBLISHED Published: 2014-05-20T10:00:00 Last Updated: 2024-08-06T10:35:57.094Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cisco Adaptive Security Appliance (ASA) Software 9.1(.5) and earlier allows remote authenticated users to cause a denial of service (device reload) via crafted attributes in a RADIUS packet, aka Bug ID CSCun69561. Additional Analyst Notes: - CVE Program Container: References: - http://tools.cisco.com/security/center/viewAlert.x?alertId=34273 - http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3264
CVE ID: CVE-2014-3265 State: PUBLISHED Published: 2014-05-20T10:00:00 Last Updated: 2024-08-06T10:35:57.128Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Auto Update Server (AUS) web framework in Cisco Security Manager 4.2 and earlier allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCuo06900. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1030260 - http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3265 - http://tools.cisco.com/security/center/viewAlert.x?alertId=34274
CVE ID: CVE-2014-3266 State: PUBLISHED Published: 2014-05-23T22:00:00 Last Updated: 2024-08-06T10:35:57.142Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the web framework in Cisco Security Manager 4.6 and earlier allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCun65189. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/58923 - http://tools.cisco.com/security/center/viewAlert.x?alertId=34340 - http://www.securityfocus.com/bid/67569 - http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3266
CVE ID: CVE-2014-3267 State: PUBLISHED Published: 2014-05-23T22:00:00 Last Updated: 2024-08-06T10:35:57.107Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco Security Manager 4.6 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that make unspecified changes, aka Bug ID CSCuo46427. Additional Analyst Notes: - CVE Program Container: References: - http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3267 - http://tools.cisco.com/security/center/viewAlert.x?alertId=34325 - http://www.securitytracker.com/id/1030271
CVE ID: CVE-2014-3268 State: PUBLISHED Published: 2014-05-20T10:00:00 Last Updated: 2024-08-06T10:35:57.102Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cisco IOS 15.2(4)M4 on Cisco Unified Border Element (CUBE) devices allows remote attackers to cause a denial of service (input-queue consumption and traffic-processing outage) via crafted RTCP packets, aka Bug ID CSCuj72215. Additional Analyst Notes: - CVE Program Container: References: - http://tools.cisco.com/security/center/viewAlert.x?alertId=34272 - http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3268
CVE ID: CVE-2014-3269 State: PUBLISHED Published: 2014-05-20T10:00:00 Last Updated: 2024-08-06T10:35:57.140Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SNMP module in Cisco IOS XE 3.5E allows remote authenticated users to cause a denial of service (device reload) by polling frequently, aka Bug ID CSCug65204. Additional Analyst Notes: - CVE Program Container: References: - http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3269 - http://tools.cisco.com/security/center/viewAlert.x?alertId=34268
CVE ID: CVE-2014-3270 State: PUBLISHED Published: 2014-05-20T10:00:00 Last Updated: 2024-08-06T10:35:57.170Z Vendors: n/a Products: n/a Problem Types: n/a Description: The DHCPv6 implementation in Cisco IOS XR allows remote attackers to cause a denial of service (process hang) via a malformed packet, aka Bug ID CSCul80924. Additional Analyst Notes: - CVE Program Container: References: - http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3270 - http://www.securitytracker.com/id/1030259
CVE ID: CVE-2014-3271 State: PUBLISHED Published: 2014-05-20T10:00:00 Last Updated: 2024-08-06T10:35:57.171Z Vendors: n/a Products: n/a Problem Types: n/a Description: The DHCPv6 implementation in Cisco IOS XR allows remote attackers to cause a denial of service (device crash) via a malformed packet, aka Bug IDs CSCum85558, CSCum20949, CSCul61849, and CSCul71149. Additional Analyst Notes: - CVE Program Container: References: - http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3271 - http://www.securitytracker.com/id/1030259
CVE ID: CVE-2014-3272 State: PUBLISHED Published: 2014-05-23T22:00:00 Last Updated: 2024-08-06T10:35:57.166Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Agent in Cisco Tidal Enterprise Scheduler (TES) 6.1 and earlier allows local users to gain privileges via crafted Tidal Job Buffers (TJB) parameters, aka Bug ID CSCuo33074. Additional Analyst Notes: - CVE Program Container: References: - http://tools.cisco.com/security/center/viewAlert.x?alertId=34339 - http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3272 - http://secunia.com/advisories/58922 - http://www.securitytracker.com/id/1030275
CVE ID: CVE-2014-3273 State: PUBLISHED Published: 2014-05-20T10:00:00 Last Updated: 2024-08-06T10:35:57.138Z Vendors: n/a Products: n/a Problem Types: n/a Description: The LLDP implementation in Cisco IOS allows remote attackers to cause a denial of service (device reload) via a malformed packet, aka Bug ID CSCum96282. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1030257 - http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3273
CVE ID: CVE-2014-3274 State: PUBLISHED Published: 2014-05-23T22:00:00 Last Updated: 2024-08-06T10:35:57.154Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cisco TelePresence System (CTS) 6.0(.5)(5) and earlier falls back to HTTP when certain HTTPS sessions cannot be established, which allows man-in-the-middle attackers to obtain sensitive directory information by leveraging a network position between CTS and Cisco Unified Communications Manager (UCM) to block HTTPS traffic, aka Bug ID CSCuj26326. Additional Analyst Notes: - CVE Program Container: References: - http://tools.cisco.com/security/center/viewAlert.x?alertId=34327 - http://tools.cisco.com/security/center/content/CiscoS
http://tools.cisco.com/security/center/viewAlert.x?alertId=34327 - http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3274 - http://www.securitytracker.com/id/1030272
CVE ID: CVE-2014-3275 State: PUBLISHED Published: 2014-05-23T22:00:00 Last Updated: 2024-08-06T10:35:57.139Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the web framework in Cisco Identity Services Engine (ISE) 1.2(.1 patch 2) and earlier allows remote authenticated users to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCul21337. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/67555 - http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3275 - http://www.securitytracker.com/id/1030273 - http://tools.cisco.com/security/center/viewAlert.x?alertId=34328
CVE ID: CVE-2014-3276 State: PUBLISHED Published: 2014-05-23T22:00:00 Last Updated: 2024-08-06T10:35:57.094Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cisco Identity Services Engine (ISE) 1.2(.1 patch 2) and earlier does not properly handle deadlock conditions during reception of crafted RADIUS accounting packets from multiple NAS devices, which allows remote authenticated users to cause a denial of service (RADIUS outage) by sourcing these packets from two origins, aka Bug ID CSCuo56780. Additional Analyst Notes: - CVE Program Container: References: - http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3276 - http://tools.cisco.com/security/center/vi
://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3276 - http://tools.cisco.com/security/center/viewAlert.x?alertId=34329 - http://www.securitytracker.com/id/1030274
CVE ID: CVE-2014-3277 State: PUBLISHED Published: 2014-05-29T17:00:00 Last Updated: 2024-08-06T10:35:57.171Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Administration GUI in the web framework in VOSS in Cisco Unified Communications Domain Manager (CDM) 9.0(.1) and earlier does not properly implement access control, which allows remote authenticated users to obtain sensitive user and group information by leveraging Location Administrator privileges and entering a crafted URL, aka Bug ID CSCum77005. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1030306 - http://tools.cisco.com/security/center/viewAlert.x?alertId=34380 - h
nces: - http://www.securitytracker.com/id/1030306 - http://tools.cisco.com/security/center/viewAlert.x?alertId=34380 - http://www.securityfocus.com/bid/67664 - http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3277 - http://secunia.com/advisories/58400
CVE ID: CVE-2014-3278 State: PUBLISHED Published: 2014-06-08T16:00:00 Last Updated: 2024-08-06T10:35:57.165Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web framework in VOSS in Cisco Unified Communications Domain Manager (CDM) does not properly implement access control, which allows remote attackers to enumerate accounts by visiting an unspecified BVSMWeb web page, aka Bug IDs CSCun39619 and CSCun45572. Additional Analyst Notes: - CVE Program Container: References: - http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3278 - http://secunia.com/advisories/58657 - http://www.securityfocus.com/bid/67924
CVE ID: CVE-2014-3279 State: PUBLISHED Published: 2014-05-29T17:00:00 Last Updated: 2024-08-06T10:35:57.157Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Administration GUI in the web framework in VOSS in Cisco Unified Communications Domain Manager (CDM) 9.0(.1) and earlier does not properly implement access control, which allows remote attackers to enumerate account names via a crafted URL, aka Bug IDs CSCun39631 and CSCun39643. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1030306 - http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3279 - http://secunia.com/advisories/58657 - http://www.securit
com/security/center/content/CiscoSecurityNotice/CVE-2014-3279 - http://secunia.com/advisories/58657 - http://www.securityfocus.com/bid/67663 - http://tools.cisco.com/security/center/viewAlert.x?alertId=34381 - http://secunia.com/advisories/58400