Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2014-2259 State: PUBLISHED Published: 2014-03-16T10:00:00 Last Updated: 2024-08-06T10:06:00.300Z Vendors: n/a Products: n/a Problem Types: n/a Description: Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 allow remote attackers to cause a denial of service (defect-mode transition) via crafted HTTPS packets. Additional Analyst Notes: - CVE Program Container: References: - http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf - http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01 - https://cert-portal.siemens.com/productcert/pdf/ssa-456423.pdf
CVE ID: CVE-2014-2260 State: PUBLISHED Published: 2014-04-30T22:00:00 Last Updated: 2024-08-06T10:06:00.320Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in plugins/main/content/js/ajenti.coffee in Eugene Pankov Ajenti 1.2.13 allows remote authenticated users to inject arbitrary web script or HTML via the command field in the Cron functionality. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/64982 - http://www.osvdb.org/102174 - http://packetstormsecurity.com/files/124804/Ajenti-1.2.13-Cross-Site-Scripting.html - https://github.com/Eugeny/ajenti/issues/233 - https://github.com/Eugeny/aje
04/Ajenti-1.2.13-Cross-Site-Scripting.html - https://github.com/Eugeny/ajenti/issues/233 - https://github.com/Eugeny/ajenti/commit/3270fd1d78391bb847b4c9ce37cf921f485b1310
CVE ID: CVE-2014-2262 State: PUBLISHED Published: 2014-02-28T18:00:00 Last Updated: 2024-08-06T10:06:00.320Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the client application in Base SAS 9.2 TS2M3, SAS 9.3 TS1M1 and TS1M2, and SAS 9.4 TS1M0 allows user-assisted remote attackers to execute arbitrary code via a crafted SAS program. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/531283/100/0/threaded - http://support.sas.com/kb/51/701.html - http://www.securityfocus.com/bid/65853 - https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140227-0_SAS_Buffer_overflow_v10.txt - http://secun
s://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140227-0_SAS_Buffer_overflow_v10.txt - http://secunia.com/advisories/57029
CVE ID: CVE-2014-2263 State: PUBLISHED Published: 2014-02-28T18:00:00 Last Updated: 2024-08-06T10:06:00.191Z Vendors: n/a Products: n/a Problem Types: n/a Description: The mpegts_write_pmt function in the MPEG2 transport stream (aka DVB) muxer (libavformat/mpegtsenc.c) in FFmpeg, possibly 2.1 and earlier, allows remote attackers to have unspecified impact and vectors, which trigger an out-of-bounds write. Additional Analyst Notes: - CVE Program Container: References: - http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=842b6c14bc - http://secunia.com/advisories/56971 - http://www.securitytracker.com/id/1029850 - https://exchange.xforce.ibmcloud.com/vulnerabilities/91174 - https://security.
tp://www.securitytracker.com/id/1029850 - https://exchange.xforce.ibmcloud.com/vulnerabilities/91174 - https://security.gentoo.org/glsa/201603-06 - http://www.securityfocus.com/bid/65560
CVE ID: CVE-2014-2264 State: PUBLISHED Published: 2014-03-02T17:00:00Z Last Updated: 2024-09-16T16:13:55.685Z Vendors: n/a Products: n/a Problem Types: n/a Description: The OpenVPN module in Synology DiskStation Manager (DSM) 4.3-3810 update 1 has a hardcoded root password of synopass, which makes it easier for remote attackers to obtain access via a VPN session. Additional Analyst Notes: - CVE Program Container: References: - http://forum.synology.com/enu/viewtopic.php?f=173&t=77644 - http://www.kb.cert.org/vuls/id/534284
CVE ID: CVE-2014-2265 State: PUBLISHED Published: 2014-03-14T10:00:00 Last Updated: 2024-08-06T10:06:00.271Z Vendors: n/a Products: n/a Problem Types: n/a Description: Rock Lobster Contact Form 7 before 3.7.2 allows remote attackers to bypass the CAPTCHA protection mechanism and submit arbitrary form data by omitting the _wpcf7_captcha_challenge_captcha-719 parameter. Additional Analyst Notes: - CVE Program Container: References: - http://contactform7.com/2014/02/26/contact-form-7-372/ - http://wordpress.org/plugins/contact-form-7/changelog - http://web.archive.org/web/20140727133642/http://www.hedgehogsecurity.co.uk/2014/02/26/contactform7-vulnerability/ - https://www.acunetix.com/vulnerabi
0727133642/http://www.hedgehogsecurity.co.uk/2014/02/26/contactform7-vulnerability/ - https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-contact-form-7-security-bypass-3-7-1/ - https://www.cvedetails.com/cve/CVE-2014-2265/
CVE ID: CVE-2014-2268 State: PUBLISHED Published: 2014-11-16T01:00:00 Last Updated: 2024-08-06T10:06:00.316Z Vendors: n/a Products: n/a Problem Types: n/a Description: views/Index.php in the Install module in vTiger 6.0 before Security Patch 2 does not properly restrict access, which allows remote attackers to re-install the application via a request that sets the X-Requested-With HTTP header, as demonstrated by executing arbitrary PHP code via the db_name parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/66757 - https://www.navixia.com/blog/entry/navixia-find-critical-vulnerabilities-in-vtiger-crm-cve-2014-2268-cve-2014-2269.html -
tps://www.navixia.com/blog/entry/navixia-find-critical-vulnerabilities-in-vtiger-crm-cve-2014-2268-cve-2014-2269.html - http://vtiger-crm.2324883.n4.nabble.com/Vtigercrm-developers-IMP-forgot-password-and-re-installation-security-fix-tt9786.html - http://www.exploit-db.com/exploits/32794
CVE ID: CVE-2014-2269 State: PUBLISHED Published: 2014-04-21T14:00:00 Last Updated: 2024-08-06T10:06:00.272Z Vendors: n/a Products: n/a Problem Types: n/a Description: modules/Users/ForgotPassword.php in vTiger 6.0 before Security Patch 2 allows remote attackers to reset the password for arbitrary users via a request containing the username, password, and confirmPassword parameters. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/66758 - http://vtiger-crm.2324883.n4.nabble.com/Vtigercrm-developers-IMP-forgot-password-and-re-installation-security-fix-tt9786.html
CVE ID: CVE-2014-2270 State: PUBLISHED Published: 2014-03-14T15:00:00 Last Updated: 2024-08-06T10:06:00.288Z Vendors: n/a Products: n/a Problem Types: n/a Description: softmagic.c in file before 5.17 and libmagic allows context-dependent attackers to cause a denial of service (out-of-bounds memory access and crash) via crafted offsets in the softmagic of a PE executable. Additional Analyst Notes: - CVE Program Container: References: - http://www.ubuntu.com/usn/USN-2163-1 - http://seclists.org/oss-sec/2014/q1/504 - http://www.ubuntu.com/usn/USN-2162-1 - http://seclists.org/oss-sec/2014/q1/473 - http://lists.opensuse.org/opensuse-updates/2014-03/msg00037.html - http://bugs.gw.com/view.php?id=3
ss-sec/2014/q1/473 - http://lists.opensuse.org/opensuse-updates/2014-03/msg00037.html - http://bugs.gw.com/view.php?id=313 - http://seclists.org/oss-sec/2014/q1/505 - http://www.php.net/ChangeLog-5.php - http://lists.opensuse.org/opensuse-updates/2014-03/msg00034.html - http://support.apple.com/kb/HT6443 - https://github.com/file/file/commit/447558595a3650db2886cd2f416ad0beba965801 - http://rhn.redhat.com/errata/RHSA-2014-1765.html - https://security.gentoo.org/glsa/201503-08 - http://lists.opensuse.org/opensuse-updates/2014-03/msg00084.html - http://www.debian.org/security/2014/dsa-2873
CVE ID: CVE-2014-2271 State: PUBLISHED Published: 2020-01-14T16:07:43 Last Updated: 2024-08-06T10:06:00.281Z Vendors: n/a Products: n/a Problem Types: n/a Description: cn.wps.moffice.common.beans.print.CloudPrintWebView in Kingsoft Office 5.3.1, as used in Huawei P2 devices before V100R001C00B043, falls back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-middle attackers to conduct downgrade attacks and execute arbitrary Java code by leveraging a network position between the client and the registry to block HTTPS traffic. Additional Analyst Notes: - CVE Program Container: References: - http://www.huawei.com/en/security/psirt/security-bulletins/security-advis
Notes: - CVE Program Container: References: - http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-401529.htm - http://www.securityfocus.com/bid/71381 - https://exchange.xforce.ibmcloud.com/vulnerabilities/99089 - https://labs.f-secure.com/advisories/kingsoft-office-remote-code-execution/ - https://labs.f-secure.com/assets/763/original/mwri_advisory_huawei_kingsoft-office.pdf
CVE ID: CVE-2014-2273 State: PUBLISHED Published: 2014-12-05T16:00:00 Last Updated: 2024-08-06T10:06:00.229Z Vendors: n/a Products: n/a Problem Types: n/a Description: The hx170dec device driver in Huawei P2-6011 before V100R001C00B043 allows local users to read and write to arbitrary memory locations via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-401529.htm - http://www.securityfocus.com/bid/71374 - https://exchange.xforce.ibmcloud.com/vulnerabilities/99088 - https://labs.mwrinfosecurity.com/system/assets/762/original/mwri_advisory_huawei_driver-root-exploit.pdf
CVE ID: CVE-2014-2274 State: PUBLISHED Published: 2018-03-19T21:00:00 Last Updated: 2024-08-06T10:05:59.998Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in the Subscribe To Comments Reloaded plugin before 140219 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via a request to the subscribe-to-comments-reloaded/options/index.php page to wp-admin/admin.php. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/subscribe-to-comments-reloaded/#developers - https://security.dxw.com/advisories/store
: - https://wordpress.org/plugins/subscribe-to-comments-reloaded/#developers - https://security.dxw.com/advisories/stored-xss-and-csrf-vulnerabilities-in-subscribe-to-comments-reloaded-140129/
CVE ID: CVE-2014-2276 State: PUBLISHED Published: 2014-03-21T14:00:00 Last Updated: 2024-08-06T10:06:00.338Z Vendors: n/a Products: n/a Problem Types: n/a Description: The FileUploadController servlet in EMC Connectrix Manager Converged Network Edition (CMCNE) before 12.1.5 does not properly restrict additions to the Connectrix Manager repository, which allows remote attackers to obtain sensitive information by importing a crafted firmware file. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1029939 - http://secunia.com/advisories/57513 - http://www.securityfocus.com/bid/66308 - https://exchange.xforce.ibmcloud.com/vulnerabilities/91987 - h
visories/57513 - http://www.securityfocus.com/bid/66308 - https://exchange.xforce.ibmcloud.com/vulnerabilities/91987 - http://archives.neohapsis.com/archives/bugtraq/2014-03/0115.html
CVE ID: CVE-2014-2277 State: PUBLISHED Published: 2017-10-17T15:00:00 Last Updated: 2024-08-06T10:06:00.379Z Vendors: n/a Products: n/a Problem Types: n/a Description: The make_temporary_filename function in perltidy 20120701-1 and earlier allows local users to obtain sensitive information or write to arbitrary files via a symlink attack, related to use of the tmpnam function. Additional Analyst Notes: - CVE Program Container: References: - http://lists.fedoraproject.org/pipermail/package-announce/2014-March/130479.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/92104 - http://www.securityfocus.com/bid/66139 - http://lists.fedoraproject.org/pipermail/package-announce/2014-March/1
/92104 - http://www.securityfocus.com/bid/66139 - http://lists.fedoraproject.org/pipermail/package-announce/2014-March/130464.html - https://bugzilla.redhat.com/show_bug.cgi?id=1074720 - http://www.openwall.com/lists/oss-security/2014/03/09/1
CVE ID: CVE-2014-2278 State: PUBLISHED Published: 2014-10-17T23:00:00 Last Updated: 2024-08-06T10:06:00.291Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted file upload vulnerability in op/op.AddFile2.php in SeedDMS (formerly LetoDMS and MyDMS) before 4.3.4 allows remote attackers to execute arbitrary code by uploading a file with an executable extension specified by the partitionIndex parameter and leveraging CVE-2014-2279.2 to access it via the directory specified by the fileId parameter. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/show/osvdb/104465 - http://archives.neohapsis.com/archives/bugtraq/2014-03/0101.html - http://sour
s: - http://osvdb.org/show/osvdb/104465 - http://archives.neohapsis.com/archives/bugtraq/2014-03/0101.html - http://sourceforge.net/p/seeddms/code/ci/master/tree/CHANGELOG - http://secunia.com/advisories/57475 - http://packetstormsecurity.com/files/125726
CVE ID: CVE-2014-2279 State: PUBLISHED Published: 2014-10-17T23:00:00 Last Updated: 2024-08-06T10:06:00.266Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple directory traversal vulnerabilities in SeedDMS (formerly LetoDMS and MyDMS) before 4.3.4 allow (1) remote authenticated users with access to the LogManagement functionality to read arbitrary files via a .. (dot dot) in the logname parameter to out/out.LogManagement.php or (2) remote attackers to write to arbitrary files via a .. (dot dot) in the fileId parameter to op/op.AddFile2.php. NOTE: vector 2 can be leveraged to execute arbitrary code by using CVE-2014-2278. Additional Analyst Notes: - CVE Program Container: Re
can be leveraged to execute arbitrary code by using CVE-2014-2278. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/show/osvdb/104466 - http://archives.neohapsis.com/archives/bugtraq/2014-03/0101.html - http://sourceforge.net/p/seeddms/code/ci/master/tree/CHANGELOG - https://exchange.xforce.ibmcloud.com/vulnerabilities/91831 - http://packetstormsecurity.com/files/125726 - http://www.securityfocus.com/bid/66256
CVE ID: CVE-2014-2280 State: PUBLISHED Published: 2014-03-20T16:00:00 Last Updated: 2024-08-06T10:06:00.221Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the search feature in SeedDMS (formerly LetoDMS and MyDMS) before 4.3.4 allows remote attackers to inject arbitrary web script or HTML via the query parameter. Additional Analyst Notes: - CVE Program Container: References: - http://archives.neohapsis.com/archives/bugtraq/2014-03/0101.html - http://sourceforge.net/p/seeddms/code/ci/master/tree/CHANGELOG - https://exchange.xforce.ibmcloud.com/vulnerabilities/91830 - http://secunia.com/advisories/57475 - http://packetstormsecurity.com/f
hange.xforce.ibmcloud.com/vulnerabilities/91830 - http://secunia.com/advisories/57475 - http://packetstormsecurity.com/files/125726
CVE ID: CVE-2014-2281 State: PUBLISHED Published: 2014-03-11T01:00:00 Last Updated: 2024-08-06T10:05:59.947Z Vendors: n/a Products: n/a Problem Types: n/a Description: The nfs_name_snoop_add_name function in epan/dissectors/packet-nfs.c in the NFS dissector in Wireshark 1.8.x before 1.8.13 and 1.10.x before 1.10.6 does not validate a certain length value, which allows remote attackers to cause a denial of service (memory corruption and application crash) via a crafted NFS packet. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/57489 - http://rhn.redhat.com/errata/RHSA-2014-0341.html - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9672 - ht
57489 - http://rhn.redhat.com/errata/RHSA-2014-0341.html - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9672 - http://secunia.com/advisories/57480 - http://www.wireshark.org/security/wnpa-sec-2014-01.html - http://lists.opensuse.org/opensuse-updates/2014-03/msg00046.html - https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_wireshark10 - http://www.securitytracker.com/id/1029907 - http://anonsvn.wireshark.org/viewvc?view=revision&revision=54875 - http://lists.opensuse.org/opensuse-updates/2014-03/msg00047.html - http://www.debian.org/security/2014/dsa-2871 - http://rhn.redhat.com/errata/RHSA-2014-0342.html - http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/
dsa-2871 - http://rhn.redhat.com/errata/RHSA-2014-0342.html - http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-nfs.c?r1=54875&r2=54874&pathrev=54875
CVE ID: CVE-2014-2282 State: PUBLISHED Published: 2014-03-11T01:00:00 Last Updated: 2024-08-06T10:06:00.382Z Vendors: n/a Products: n/a Problem Types: n/a Description: The dissect_protocol_data_parameter function in epan/dissectors/packet-m3ua.c in the M3UA dissector in Wireshark 1.10.x before 1.10.6 does not properly allocate memory, which allows remote attackers to cause a denial of service (application crash) via a crafted SS7 MTP3 packet. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/57480 - http://www.wireshark.org/security/wnpa-sec-2014-02.html - http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-m3ua.c?r1=51608&r2=51607&pa
ity/wnpa-sec-2014-02.html - http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-m3ua.c?r1=51608&r2=51607&pathrev=51608 - http://lists.opensuse.org/opensuse-updates/2014-03/msg00046.html - https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_wireshark10 - http://www.securitytracker.com/id/1029907 - http://anonsvn.wireshark.org/viewvc?view=revision&revision=51608 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9699
CVE ID: CVE-2014-2283 State: PUBLISHED Published: 2014-03-11T01:00:00 Last Updated: 2024-08-06T10:06:00.273Z Vendors: n/a Products: n/a Problem Types: n/a Description: epan/dissectors/packet-rlc in the RLC dissector in Wireshark 1.8.x before 1.8.13 and 1.10.x before 1.10.6 uses inconsistent memory-management approaches, which allows remote attackers to cause a denial of service (use-after-free error and application crash) via a crafted UMTS Radio Link Control packet. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/57489 - http://secunia.com/advisories/57480 - http://lists.opensuse.org/opensuse-updates/2014-03/msg00046.html - https://blogs.oracle
//secunia.com/advisories/57480 - http://lists.opensuse.org/opensuse-updates/2014-03/msg00046.html - https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_wireshark10 - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=217293ba4a0353bf5d657e74fe8623dd3c86fe08 - http://www.securitytracker.com/id/1029907 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9802 - http://lists.opensuse.org/opensuse-updates/2014-03/msg00047.html - http://www.debian.org/security/2014/dsa-2871 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9730 - http://rhn.redhat.com/errata/RHSA-2014-0342.html - http://www.wireshark.org/security/wnpa-sec-2014-03.html
CVE ID: CVE-2014-2284 State: PUBLISHED Published: 2014-03-24T14:00:00 Last Updated: 2024-08-06T10:06:00.331Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Linux implementation of the ICMP-MIB in Net-SNMP 5.5 before 5.5.2.1, 5.6.x before 5.6.2.1, and 5.7.x before 5.7.2.1 does not properly validate input, which allows remote attackers to cause a denial of service via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-updates/2014-03/msg00060.html - http://lists.opensuse.org/opensuse-updates/2014-03/msg00061.html - http://secunia.com/advisories/57583 - http://secunia.com/advisories/57124 - http://www.ubuntu.c
/2014-03/msg00061.html - http://secunia.com/advisories/57583 - http://secunia.com/advisories/57124 - http://www.ubuntu.com/usn/USN-2166-1 - http://secunia.com/advisories/59974 - http://rhn.redhat.com/errata/RHSA-2014-0321.html - http://sourceforge.net/p/net-snmp/code/ci/a1fd64716f6794c55c34d77e618210238a73bfa1/ - http://secunia.com/advisories/57870 - http://secunia.com/advisories/57526 - http://www.gentoo.org/security/en/glsa/glsa-201409-02.xml - http://comments.gmane.org/gmane.comp.security.oss.general/12284
CVE ID: CVE-2014-2285 State: PUBLISHED Published: 2014-04-27T22:00:00 Last Updated: 2024-08-06T10:05:59.996Z Vendors: n/a Products: n/a Problem Types: n/a Description: The perl_trapd_handler function in perl/TrapReceiver/TrapReceiver.xs in Net-SNMP 5.7.3.pre3 and earlier, when using certain Perl versions, allows remote attackers to cause a denial of service (snmptrapd crash) via an empty community string in an SNMP trap, which triggers a NULL pointer dereference within the newSVpv function in Perl. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1072778 - http://lists.opensuse.org/opensuse-updates/2014-03/msg00060.html - http://lis
zilla.redhat.com/show_bug.cgi?id=1072778 - http://lists.opensuse.org/opensuse-updates/2014-03/msg00060.html - http://lists.opensuse.org/opensuse-updates/2014-03/msg00061.html - https://rhn.redhat.com/errata/RHSA-2014-0322.html - http://secunia.com/advisories/59974 - http://www.gentoo.org/security/en/glsa/glsa-201409-02.xml - http://sourceforge.net/p/net-snmp/patches/1275/ - http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 - http://www.nntp.perl.org/group/perl.perl5.porters/2006/09/msg116250.html - https://bugzilla.redhat.com/show_bug.cgi?id=1072044 - http://comments.gmane.org/gmane.comp.security.oss.general/12284
CVE ID: CVE-2014-2286 State: PUBLISHED Published: 2014-04-18T19:00:00 Last Updated: 2024-08-06T10:06:00.334Z Vendors: n/a Products: n/a Problem Types: n/a Description: main/http.c in Asterisk Open Source 1.8.x before 1.8.26.1, 11.8.x before 11.8.1, and 12.1.x before 12.1.1, and Certified Asterisk 1.8.x before 1.8.15-cert5 and 11.6 before 11.6-cert2, allows remote attackers to cause a denial of service (stack consumption) and possibly execute arbitrary code via an HTTP request with a large number of Cookie headers. Additional Analyst Notes: - CVE Program Container: References: - https://issues.asterisk.org/jira/browse/ASTERISK-23340 - http://downloads.asterisk.org/pub/security/AST-2014-001-1.
s: - https://issues.asterisk.org/jira/browse/ASTERISK-23340 - http://downloads.asterisk.org/pub/security/AST-2014-001-1.8.diff - http://downloads.asterisk.org/pub/security/AST-2014-001.html - http://www.securityfocus.com/bid/66093 - http://www.mandriva.com/security/advisories?name=MDVSA-2014:078 - http://lists.fedoraproject.org/pipermail/package-announce/2014-March/130426.html - http://lists.fedoraproject.org/pipermail/package-announce/2014-March/130400.html
CVE ID: CVE-2014-2287 State: PUBLISHED Published: 2014-04-18T19:00:00 Last Updated: 2024-08-06T10:06:00.091Z Vendors: n/a Products: n/a Problem Types: n/a Description: channels/chan_sip.c in Asterisk Open Source 1.8.x before 1.8.26.1, 11.8.x before 11.8.1, and 12.1.x before 12.1.1, and Certified Asterisk 1.8.15 before 1.8.15-cert5 and 11.6 before 11.6-cert2, when chan_sip has a certain configuration, allows remote authenticated users to cause a denial of service (channel and file descriptor consumption) via an INVITE request with a (1) Session-Expires or (2) Min-SE header with a malformed or invalid value. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfo
ith a malformed or invalid value. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/66094 - http://downloads.asterisk.org/pub/security/AST-2014-002.html - https://issues.asterisk.org/jira/browse/ASTERISK-23373 - http://www.mandriva.com/security/advisories?name=MDVSA-2014:078 - http://lists.fedoraproject.org/pipermail/package-announce/2014-March/130426.html - http://lists.fedoraproject.org/pipermail/package-announce/2014-March/130400.html - http://downloads.asterisk.org/pub/security/AST-2014-002-1.8.diff