Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2014-3802 State: PUBLISHED Published: 2014-05-20T23:00:00 Last Updated: 2024-08-06T10:57:17.127Z Vendors: n/a Products: n/a Problem Types: n/a Description: msdia.dll in Microsoft Debug Interface Access (DIA) SDK, as distributed in Microsoft Visual Studio before 2013, does not properly validate an unspecified variable before use in calculating a dynamic-call address, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted PDB file. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/67398 - http://zerodayinitiative.com/advisories/ZDI-14-129/
CVE ID: CVE-2014-3803 State: PUBLISHED Published: 2014-05-21T10:00:00 Last Updated: 2024-08-06T10:57:17.574Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SpeechInput feature in Blink, as used in Google Chrome before 35.0.1916.114, allows remote attackers to enable microphone access and obtain speech-recognition text without indication via an INPUT element with a -x-webkit-speech attribute. Additional Analyst Notes: - CVE Program Container: References: - https://src.chromium.org/viewvc/blink?revision=171373&view=revision - http://www.securityfocus.com/bid/67582 - https://code.google.com/p/chromium/issues/detail?id=360448 - http://googlechromereleases.blogspot.com/2014/05/sta
7582 - https://code.google.com/p/chromium/issues/detail?id=360448 - http://googlechromereleases.blogspot.com/2014/05/stable-channel-update_20.html - http://secunia.com/advisories/60372 - http://blog.guya.net/2014/04/07/to-listen-without-consent-abusing-the-html5-speech/
CVE ID: CVE-2014-3804 State: PUBLISHED Published: 2014-06-13T14:00:00 Last Updated: 2024-08-06T10:57:17.445Z Vendors: n/a Products: n/a Problem Types: n/a Description: The av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows remote attackers to execute arbitrary commands via a crafted (1) update_system_info_debian_package, (2) ossec_task, (3) set_ossim_setup admin_ip, (4) sync_rserver, or (5) set_ossim_setup framework_ip request, a different vulnerability than CVE-2014-3805. Additional Analyst Notes: - CVE Program Container: References: - http://zerodayinitiative.com/advisories/ZDI-14-200/ - http://zerodayinitiative.com/advisories/ZDI-14-202/ - http://zerodayinitiative.com/advisor
.com/advisories/ZDI-14-200/ - http://zerodayinitiative.com/advisories/ZDI-14-202/ - http://zerodayinitiative.com/advisories/ZDI-14-197/ - http://zerodayinitiative.com/advisories/ZDI-14-196/ - http://forums.alienvault.com/discussion/2690 - https://www.exploit-db.com/exploits/42708/ - http://zerodayinitiative.com/advisories/ZDI-14-201/
CVE ID: CVE-2014-3805 State: PUBLISHED Published: 2014-06-13T14:00:00 Last Updated: 2024-08-06T10:57:17.108Z Vendors: n/a Products: n/a Problem Types: n/a Description: The av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows remote attackers to execute arbitrary commands via a crafted (1) get_license, (2) get_log_line, or (3) update_system/upgrade_pro_web request, a different vulnerability than CVE-2014-3804. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/42709/ - http://zerodayinitiative.com/advisories/ZDI-14-199/ - http://zerodayinitiative.com/advisories/ZDI-14-204/ - http://forums.alienvault.com/discussion/2690 - http://zero
-199/ - http://zerodayinitiative.com/advisories/ZDI-14-204/ - http://forums.alienvault.com/discussion/2690 - http://zerodayinitiative.com/advisories/ZDI-14-198/
CVE ID: CVE-2014-3806 State: PUBLISHED Published: 2014-05-21T14:00:00 Last Updated: 2024-08-06T10:57:16.954Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in cgi-bin/help/doIt.cgi in VMTurbo Operations Manager before 4.6 allows remote attackers to read arbitrary files via a .. (dot dot) in the xml_path parameter. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/show/osvdb/106776 - http://www.securityfocus.com/archive/1/532061/100/0/threaded - http://www.exploit-db.com/exploits/33334 - http://packetstormsecurity.com/files/126550/VM-Turbo-Operations-Manager-4.5.x-Directory-Traversal.html - http://www.securityfocus.
ketstormsecurity.com/files/126550/VM-Turbo-Operations-Manager-4.5.x-Directory-Traversal.html - http://www.securityfocus.com/bid/67292
CVE ID: CVE-2014-3807 State: PUBLISHED Published: 2014-05-21T14:00:00Z Last Updated: 2024-09-16T16:49:10.665Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in BarracudaDrive 6.7.2 allow remote attackers to inject arbitrary web script or HTML via the (1) blog, (2) bloggeruser, or (3) bloggerpasswd parameter to private/manage/. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/67428 - http://secunia.com/advisories/58712 - http://packetstormsecurity.com/files/126645/BarracudaDrive-6.7.2-Cross-Site-Scripting.html
CVE ID: CVE-2014-3808 State: PUBLISHED Published: 2014-05-21T14:00:00 Last Updated: 2024-08-06T10:57:17.575Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in BarracudaDrive before 6.7.2 allow remote attackers to inject arbitrary web script or HTML via the (1) role parameter to roles.lsp, (2) name parameter to user.lsp, (3) path parameter to wizard/setuser.lsp, (4) host parameter to tunnelconstr.lsp, or (5) newpath parameter to wfsconstr.lsp in rtl/protected/admin/. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/58309 - http://www.securityfocus.com/bid/67138 - http://secpod.org/blo
iner: References: - http://secunia.com/advisories/58309 - http://www.securityfocus.com/bid/67138 - http://secpod.org/blog/?p=2309 - http://secpod.org/advisories/SecPod_Advistory_BarracudaDrive_6.7.1_Mult_XSS_Vuln.txt
CVE ID: CVE-2014-3809 State: PUBLISHED Published: 2020-01-31T21:55:18 Last Updated: 2024-08-06T10:57:17.259Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the management interface in Alcatel-Lucent 1830 Photonic Service Switch (PSS) 6.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the myurl parameter to menu/pop.html. Additional Analyst Notes: - CVE Program Container: References: - https://www.securityfocus.com/archive/1/534124
CVE ID: CVE-2014-3810 State: PUBLISHED Published: 2014-06-19T14:00:00 Last Updated: 2024-08-06T10:57:17.208Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in administration/profiles.php in BoonEx Dolphin 7.1.4 and earlier allows remote authenticated administrators to execute arbitrary SQL commands via the members[] parameter. NOTE: this can be exploited by remote attackers by leveraging CVE-2014-4333. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/127148/Dolphin-7.1.4-SQL-Injection.html - http://www.securityfocus.com/bid/68091 - http://www.securityfocus.com/archive/1/532468/100/0/threaded - https:
on.html - http://www.securityfocus.com/bid/68091 - http://www.securityfocus.com/archive/1/532468/100/0/threaded - https://www.htbridge.com/advisory/HTB23216 - http://www.boonex.com/forums/topic/Medium-Risk-Security-Vulnerability-in-Dolphin-7-1.htm
CVE ID: CVE-2014-3811 State: PUBLISHED Published: 2014-09-29T14:00:00 Last Updated: 2024-08-06T10:57:17.329Z Vendors: n/a Products: n/a Problem Types: n/a Description: Juniper Installer Service (JIS) Client 7.x before 7.4R6 for Windows and Junos Pulse Client before 4.0R6 allows local users to gain privileges via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10644
CVE ID: CVE-2014-3812 State: PUBLISHED Published: 2014-06-13T14:00:00 Last Updated: 2024-08-06T10:57:17.827Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Juniper Junos Pulse Secure Access Service (SSL VPN) devices with IVE OS before 7.4r5 and 8.x before 8.0r1 and Junos Pulse Access Control Service (UAC) before 4.4r5 and 5.x before 5.0r1 enable cipher suites with weak encryption algorithms, which make it easier for remote attackers to obtain sensitive information by sniffing the network. Additional Analyst Notes: - CVE Program Container: References: - http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10628
CVE ID: CVE-2014-3813 State: PUBLISHED Published: 2014-06-13T14:00:00 Last Updated: 2024-08-06T10:57:17.034Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in the Juniper Networks NetScreen Firewall products with ScreenOS before 6.3r17, when configured to use the internal DNS lookup client, allows remote attackers to cause a denial of service (crash and reboot) via vectors related to a DNS lookup. Additional Analyst Notes: - CVE Program Container: References: - http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10631 - http://secunia.com/advisories/59026
CVE ID: CVE-2014-3814 State: PUBLISHED Published: 2014-06-13T14:00:00 Last Updated: 2024-08-06T10:57:17.549Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Juniper Networks NetScreen Firewall devices with ScreenOS before 6.3r17, when configured to use the internal DNS lookup client, allows remote attackers to cause a denial of service (crash and reboot) via a sequence of malformed packets to the device IP. Additional Analyst Notes: - CVE Program Container: References: - http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10632 - http://secunia.com/advisories/59026
CVE ID: CVE-2014-3815 State: PUBLISHED Published: 2014-07-11T20:00:00 Last Updated: 2024-08-06T10:57:17.296Z Vendors: n/a Products: n/a Problem Types: n/a Description: Juniper Junos 12.1X46 before 12.1X46-D20 and 12.1X47 before 12.1X47-D10 on SRX Series devices allows remote attackers to cause a denial of service (flowd crash) via a crafted SIP packet. Additional Analyst Notes: - CVE Program Container: References: - https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10633 - http://www.securityfocus.com/bid/68551 - http://www.securitytracker.com/id/1030557
CVE ID: CVE-2014-3816 State: PUBLISHED Published: 2014-07-11T20:00:00 Last Updated: 2024-08-06T10:57:17.089Z Vendors: n/a Products: n/a Problem Types: n/a Description: Juniper Junos 11.4 before 11.4R12, 12.1 before 12.1R11, 12.1X44 before 12.1X44-D35, 12.1X45 before 12.1X45-D30, 12.1X46 before 12.1X46-D20, 12.1X47 before 12.1X47-D10, 12.2 before 12.2R8-S2, 12.3 before 12.3R7, 13.1 before 13.1R4-S2, 13.2 before 13.2R5, 13.3 before 13.3R2-S2, and 14.1 before 14.1R1 allows remote authenticated users to gain privileges via unspecified combinations of CLI commands and arguments. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1030559 - https://kb
Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1030559 - https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10634
CVE ID: CVE-2014-3817 State: PUBLISHED Published: 2014-07-11T20:00:00 Last Updated: 2024-08-06T10:57:17.363Z Vendors: n/a Products: n/a Problem Types: n/a Description: Juniper Junos 11.4 before 11.4R12, 12.1X44 before 12.1X44-D32, 12.1X45 before 12.1X45-D25, 12.1X46 before 12.1X46-D20, and 12.1X47 before 12.1X47-D10 on SRX Series devices, when NAT protocol translation from IPv4 to IPv6 is enabled, allows remote attackers to cause a denial of service (flowd hang or crash) via a crafted packet. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/68545 - http://secunia.com/advisories/59136 - https://kb.juniper.net/InfoCenter/index?page=content&id=JS
tyfocus.com/bid/68545 - http://secunia.com/advisories/59136 - https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10635 - http://www.securitytracker.com/id/1030558
CVE ID: CVE-2014-3818 State: PUBLISHED Published: 2014-10-14T14:00:00 Last Updated: 2024-08-06T10:57:17.406Z Vendors: n/a Products: n/a Problem Types: n/a Description: Juniper Junos OS 9.1 through 11.4 before 11.4R11, 12.1 before R10, 12.1X44 before D40, 12.1X46 before D30, 12.1X47 before D11 and 12.147-D15, 12.1X48 before D41 and D62, 12.2 before R8, 12.2X50 before D70, 12.3 before R6, 13.1 before R4-S2, 13.1X49 before D49, 13.1X50 before 30, 13.2 before R4, 13.2X50 before D20, 13.2X51 before D25, 13.2X52 before D15, 13.3 before R2, and 14.1 before R1, when supporting 4-byte AS numbers and a BGP peer does not, allows remote attackers to cause a denial of service (memory corruption and RDP r
te AS numbers and a BGP peer does not, allows remote attackers to cause a denial of service (memory corruption and RDP routing process crash and restart) via crafted transitive attributes in a BGP UPDATE. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1031009 - https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10653
CVE ID: CVE-2014-3819 State: PUBLISHED Published: 2014-07-11T20:00:00 Last Updated: 2024-08-06T10:57:17.411Z Vendors: n/a Products: n/a Problem Types: n/a Description: Juniper Junos 11.4 before 11.4R12, 12.1 before 12.1R10, 12.1X44 before 12.1X44-D35, 12.1X45 before 12.1X45-D25, 12.1X46 before 12.1X46-D20, 12.1X47 before 12.1X47-D10, 12.2 before 12.2R8, 12.3 before 12.3R7, 13.1 before 13.1R4, 13.2 before 13.2R4, 13.3 before 13.3R2, and 14.1 before 14.1R1, when Auto-RP is enabled, allows remote attackers to cause a denial of service (RDP routing process crash and restart) via a malformed PIM packet. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.co
a a malformed PIM packet. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1030561 - http://www.securityfocus.com/bid/68539 - https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10637
CVE ID: CVE-2014-3820 State: PUBLISHED Published: 2014-09-29T14:00:00 Last Updated: 2024-08-06T10:57:17.431Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the SSL VPN/UAC web server in the Juniper Junos Pulse Secure Access Service (SSL VPN) devices with IVE OS 7.1 before 7.1r16, 7.4 before 7.4r3, and 8.0 before 8.0r1 and the Juniper Junos Pulse Access Control Service devices with UAC OS 4.1 before 4.1r8, 4.4 before 4.4r3 and 5.0 before 5.0r1 allows remote administrators to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://kb.juniper.net/InfoCenter/index
cified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10645 - http://www.securitytracker.com/id/1030852
CVE ID: CVE-2014-3821 State: PUBLISHED Published: 2014-07-11T20:00:00 Last Updated: 2024-08-06T10:57:17.262Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in SRX Web Authentication (webauth) in Juniper Junos 11.4 before 11.4R11, 12.1X44 before 12.1X44-D34, 12.1X45 before 12.1X45-D25, 12.1X46 before 12.1X46-D20, and 12.1X47 before 12.1X47-D10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10640 - http://www.securityfocus.com/bid/68548 - http://www.securitytracker.com/id/1030563
CVE ID: CVE-2014-3822 State: PUBLISHED Published: 2014-07-11T20:00:00 Last Updated: 2024-08-06T10:57:17.621Z Vendors: n/a Products: n/a Problem Types: n/a Description: Juniper Junos 11.4 before 11.4R8, 12.1 before 12.1R5, 12.1X44 before 12.1X44-D20, 12.1X45 before 12.1X45-D15, 12.1X46 before 12.1X46-D10, and 12.1X47 before 12.1X47-D10 on SRX Series devices, allows remote attackers to cause a denial of service (flowd crash) via a malformed packet, related to translating IPv6 to IPv4. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1030560 - https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10641
CVE ID: CVE-2014-3823 State: PUBLISHED Published: 2014-09-29T14:00:00 Last Updated: 2024-08-06T10:57:17.223Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Juniper Junos Pulse Secure Access Service (SSL VPN) devices with IVE OS 8.0 before 8.0r1, 7.4 before 7.4r5, and 7.1 before 7.1r18 allows remote attackers to conduct clickjacking attacks via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10647
CVE ID: CVE-2014-3824 State: PUBLISHED Published: 2014-09-29T14:00:00 Last Updated: 2024-08-06T10:57:17.562Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the web server in the Juniper Junos Pulse Secure Access Service (SSL VPN) devices with IVE OS 8.0 before 8.0r6, 7.4 before 7.4r13, and 7.1 before 7.1r20 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/69804 - https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10646
CVE ID: CVE-2014-3825 State: PUBLISHED Published: 2014-10-14T14:00:00 Last Updated: 2024-08-06T10:57:17.053Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Juniper SRX Series devices with Junos 11.4 before 11.4R12-S4, 12.1X44 before 12.1X44-D40, 12.1X45 before 12.1X45-D30, 12.1X46 before 12.1X46-D25, and 12.1X47 before 12.1X47-D10, when an Application Layer Gateway (ALG) is enabled, allows remote attackers to cause a denial of service (flowd crash) via a crafted packet. Additional Analyst Notes: - CVE Program Container: References: - https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10650 - http://www.securitytracker.com/id/1031007
CVE ID: CVE-2014-3826 State: PUBLISHED Published: 2020-02-11T18:48:04 Last Updated: 2024-08-06T10:57:17.832Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in MyBB before 1.6.13 allows remote authenticated users to inject arbitrary web script or HTML via the name parameter in the edit action of the config-profile_fields module. Additional Analyst Notes: - CVE Program Container: References: - http://adamziaja.com/poc/201312-xss-mybb.html
CVE ID: CVE-2014-3827 State: PUBLISHED Published: 2020-02-11T18:23:37 Last Updated: 2024-08-06T10:57:17.354Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the MyBB (aka MyBulletinBoard) before 1.8.4 allow remote authenticated users to inject arbitrary web script or HTML via the title parameter in the (1) edit or (2) add action in the user-users module or the (3) finduser action or the name parameter in an (4) edit action in the user-user module or the (5) editprofile action to modcp.php. Additional Analyst Notes: - CVE Program Container: References: - http://blog.mybb.com/2015/02/15/mybb-1-8-4-released-feature-update-securit
Notes: - CVE Program Container: References: - http://blog.mybb.com/2015/02/15/mybb-1-8-4-released-feature-update-security-maintenance-release/ - https://adamziaja.com/poc/201312-xss-mybb.html
CVE ID: CVE-2014-3828 State: PUBLISHED Published: 2014-10-23T01:00:00 Last Updated: 2024-08-06T10:57:17.781Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in Centreon 2.5.1 and Centreon Enterprise Server 2.2 (fixed in Centreon web 2.5.3) allow remote attackers to execute arbitrary SQL commands via (1) the index_id parameter to views/graphs/common/makeXML_ListMetrics.php, (2) the sid parameter to views/graphs/GetXmlTree.php, (3) the session_id parameter to views/graphs/graphStatus/displayServiceStatus.php, (4) the mnftr_id parameter to configuration/configObject/traps/GetXMLTrapsForVendor.php, or (5) the index parameter to common/javascript/
parameter to configuration/configObject/traps/GetXMLTrapsForVendor.php, or (5) the index parameter to common/javascript/commandGetArgs/cmdGetExample.php in include/. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2014/Oct/78 - http://www.kb.cert.org/vuls/id/298796 - http://www.securityfocus.com/bid/70648 - https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.5/centreon-2.5.3.html - https://github.com/centreon/centreon/commit/cc2109804dd69057cb209037113796ec5ffdce90#diff-e328097503b14fbb117e0db798aefcde
CVE ID: CVE-2014-3829 State: PUBLISHED Published: 2014-10-23T01:00:00 Last Updated: 2024-08-06T10:57:17.284Z Vendors: n/a Products: n/a Problem Types: n/a Description: displayServiceStatus.php in Centreon 2.5.1 and Centreon Enterprise Server 2.2 (fixed in Centreon web 2.5.3) allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) session_id or (2) template_id parameter, related to the command_line variable. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2014/Oct/78 - http://www.kb.cert.org/vuls/id/298796 - https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.5/centreon-2.5.3.
g/vuls/id/298796 - https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.5/centreon-2.5.3.html - https://github.com/centreon/centreon/commit/cc2109804dd69057cb209037113796ec5ffdce90#diff-e328097503b14fbb117e0db798aefcde
CVE ID: CVE-2014-3830 State: PUBLISHED Published: 2014-10-20T16:00:00 Last Updated: 2024-08-06T10:57:17.067Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in info.php in TomatoCart 1.1.8.6.1 allows remote attackers to inject arbitrary web script or HTML via the faqs_id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://breaking.technology/advisories/CVE-2014-3830.txt - http://packetstormsecurity.com/files/127785/TomatoCart-1.x-Cross-Site-Scripting-SQL-Injection.html
CVE ID: CVE-2014-3831 State: REJECTED Published: 2014-05-22T19:00:00 Last Updated: 2014-05-22T18:57:00 Description: No description available.
CVE ID: CVE-2014-3832 State: PUBLISHED Published: 2014-06-04T14:00:00 Last Updated: 2024-08-06T10:57:17.314Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Documents component in ownCloud Server 6.0.x before 6.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to the print_unescaped function. Additional Analyst Notes: - CVE Program Container: References: - http://owncloud.org/about/security/advisories/oc-sa-2014-010
CVE ID: CVE-2014-3833 State: PUBLISHED Published: 2014-06-04T14:00:00 Last Updated: 2024-08-06T10:57:17.575Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the (1) Gallery and (2) core components in ownCloud Server before 5.016 and 6.0.x before 6.0.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to the print_unescaped function. Additional Analyst Notes: - CVE Program Container: References: - http://owncloud.org/about/security/advisories/oc-sa-2014-010
CVE ID: CVE-2014-3834 State: PUBLISHED Published: 2014-06-04T14:00:00 Last Updated: 2024-08-06T10:57:17.560Z Vendors: n/a Products: n/a Problem Types: n/a Description: ownCloud Server before 6.0.3 does not properly check permissions, which allows remote authenticated users to (1) access the contacts of other users via the address book or (2) rename files via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://owncloud.org/about/security/advisories/oc-sa-2014-011/ - http://owncloud.org/about/security/advisories/oc-sa-2014-013/