Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2014-2022 State: PUBLISHED Published: 2014-10-15T14:00:00 Last Updated: 2024-08-06T09:58:16.189Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in includes/api/4/breadcrumbs_create.php in vBulletin 4.2.2, 4.2.1, 4.2.0 PL2, and earlier allows remote authenticated users to execute arbitrary SQL commands via the conceptid argument in an xmlrpc API request. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1031001 - http://www.securityfocus.com/bid/70417 - http://packetstormsecurity.com/files/128696/vBulletin-4.x-SQL-Injection.html - https://github.com/tintinweb/pub/tree/master/pocs/cve-2014-2022
rity.com/files/128696/vBulletin-4.x-SQL-Injection.html - https://github.com/tintinweb/pub/tree/master/pocs/cve-2014-2022 - http://seclists.org/fulldisclosure/2014/Oct/56
CVE ID: CVE-2014-2023 State: PUBLISHED Published: 2017-10-26T20:00:00 Last Updated: 2024-08-06T09:58:16.312Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in the Tapatalk plugin 4.9.0 and earlier and 5.x through 5.2.1 for vBulletin allow remote attackers to execute arbitrary SQL commands via a crafted xmlrpc API request to (1) unsubscribe_forum.php or (2) unsubscribe_topic.php in mobiquo/functions/. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/70418 - http://packetstormsecurity.com/files/128854/vBulletin-4.x-Tapatalk-Blind-SQL-Injection.html - http://seclists.org/fulldisclosure/2014/Oct/5
ecurity.com/files/128854/vBulletin-4.x-Tapatalk-Blind-SQL-Injection.html - http://seclists.org/fulldisclosure/2014/Oct/57 - http://www.exploit-db.com/exploits/35102 - https://github.com/tintinweb/pub/tree/master/pocs/cve-2014-2023
CVE ID: CVE-2014-2024 State: PUBLISHED Published: 2014-03-14T14:00:00 Last Updated: 2024-08-06T09:58:16.290Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in classes/controller/error.php in Open Classifieds 2 before 2.1.3 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to shared-apartments-rooms/. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/open-classifieds/openclassifieds2/issues/556 - http://www.securityfocus.com/archive/1/531428/100/0/threaded - https://www.htbridge.com/advisory/HTB23204 - https://github.com/open-classifieds/openclassifieds2/commit/45ee8fb601a91b8
https://www.htbridge.com/advisory/HTB23204 - https://github.com/open-classifieds/openclassifieds2/commit/45ee8fb601a91b8a4238229580a32a4fd8d96ef9
CVE ID: CVE-2014-2025 State: PUBLISHED Published: 2020-01-31T22:14:04 Last Updated: 2024-08-06T09:58:16.181Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted file upload vulnerability in an unspecified third party tool in United Planet Intrexx Professional before 5.2 Online Update 0905 and 6.x before 6.0 Online Update 10 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.christian-schneider.net/advisories/CVE-2014-2025.txt - https://help.unitedplanet.com/?rq_AppGuid=C203A277EDDF9AD2492B776B996B20D4A7C58395&r
.net/advisories/CVE-2014-2025.txt - https://help.unitedplanet.com/?rq_AppGuid=C203A277EDDF9AD2492B776B996B20D4A7C58395&rq_TargetPageGuid=2EBBF802B1970FE31EFC8A34108DF3F47E7A8EEC&rq_RecId=31&rq_SourceAppGuid=C203A277EDDF9AD2492B776B996B20D4A7C58395&rq_SourcePageGuid=7A91F4B76FFC41A18F4EA4ACE26F31E033C5B018&rq_SourceRecId=31 - https://exchange.xforce.ibmcloud.com/vulnerabilities/99568
CVE ID: CVE-2014-2026 State: PUBLISHED Published: 2014-12-19T15:00:00 Last Updated: 2024-08-06T09:58:16.300Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the search functionality in United Planet Intrexx Professional before 5.2 Online Update 0905 and 6.x before 6.0 Online Update 10 allows remote attackers to inject arbitrary web script or HTML via the request parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.christian-schneider.net/advisories/CVE-2014-2026.txt - http://packetstormsecurity.com/files/129590/Intrexx-Professional-6.0-5.2-Cross-Site-Scripting.html - http://www.securityfocus.com/bid/7167
security.com/files/129590/Intrexx-Professional-6.0-5.2-Cross-Site-Scripting.html - http://www.securityfocus.com/bid/71673 - https://help.unitedplanet.com/?rq_AppGuid=C203A277EDDF9AD2492B776B996B20D4A7C58395&rq_TargetPageGuid=2EBBF802B1970FE31EFC8A34108DF3F47E7A8EEC&rq_RecId=32&rq_SourceAppGuid=C203A277EDDF9AD2492B776B996B20D4A7C58395&rq_SourcePageGuid=7A91F4B76FFC41A18F4EA4ACE26F31E033C5B018&rq_SourceRecId=32 - http://www.securityfocus.com/archive/1/534230/100/0/threaded
CVE ID: CVE-2014-2027 State: PUBLISHED Published: 2015-03-31T14:00:00 Last Updated: 2024-08-06T09:58:16.188Z Vendors: n/a Products: n/a Problem Types: n/a Description: eGroupware before 1.8.006.20140217 allows remote attackers to conduct PHP object injection attacks, delete arbitrary files, and possibly execute arbitrary code via the (1) addr_fields or (2) trans parameter to addressbook/csv_import.php, (3) cal_fields or (4) trans parameter to calendar/csv_import.php, (5) info_fields or (6) trans parameter to csv_import.php in (a) projectmanager/ or (b) infolog/, or (7) processed parameter to preferences/inc/class.uiaclprefs.inc.php. Additional Analyst Notes: - CVE Program Container: Referenc
essed parameter to preferences/inc/class.uiaclprefs.inc.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.mandriva.com/security/advisories?name=MDVSA-2015:087 - http://openwall.com/lists/oss-security/2014/02/19/4 - http://openwall.com/lists/oss-security/2014/02/19/10 - http://sourceforge.net/projects/egroupware/files/eGroupware-1.8/README/download - http://advisories.mageia.org/MGASA-2014-0116.html - https://security.gentoo.org/glsa/201711-12
CVE ID: CVE-2014-2029 State: PUBLISHED Published: 2017-09-28T19:00:00 Last Updated: 2024-08-06T09:58:16.182Z Vendors: n/a Products: n/a Problem Types: n/a Description: The automatic version check functionality in the tools in Percona Toolkit 2.1 allows man-in-the-middle attackers to obtain sensitive information or execute arbitrary code by leveraging use of HTTP to download configuration information from v.percona.com. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.novell.com/show_bug.cgi?id=864194 - http://www.openwall.com/lists/oss-security/2014/02/19/14 - https://bugs.launchpad.net/percona-toolkit/+bug/1279502
CVE ID: CVE-2014-2030 State: PUBLISHED Published: 2020-02-06T14:58:56 Last Updated: 2024-08-06T09:58:16.263Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in the WritePSDImage function in coders/psd.c in ImageMagick, possibly 6.8.8-5, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PSD image, involving the L%06ld string, a different vulnerability than CVE-2014-1947. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2014/02/12/2 - http://www.openwall.com/lists/oss-security/2014/02/13/5 - http://www.openwall.com/lists/oss-security/201
/2014/02/12/2 - http://www.openwall.com/lists/oss-security/2014/02/13/5 - http://www.openwall.com/lists/oss-security/2014/02/19/13 - https://bugzilla.redhat.com/show_bug.cgi?id=1064098 - http://lists.opensuse.org/opensuse-updates/2014-03/msg00032.html - http://lists.opensuse.org/opensuse-updates/2014-03/msg00039.html - http://ubuntu.com/usn/usn-2132-1 - https://web.archive.org/web/20090120112751/http://trac.imagemagick.org/changeset/13736
CVE ID: CVE-2014-2031 State: PUBLISHED Published: 2018-03-20T21:00:00 Last Updated: 2024-08-06T09:58:16.224Z Vendors: n/a Products: n/a Problem Types: n/a Description: Deadwood before 2.3.09, 3.x before 3.2.05, and as used in MaraDNS before 1.4.14 and 2.x before 2.0.09, allow remote attackers to cause a denial of service (out-of-bounds read and crash) by leveraging permission to perform recursive queries against Deadwood, related to a logic error. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2014/02/19/15 - https://bugzilla.redhat.com/show_bug.cgi?id=1066609 - https://exchange.xforce.ibmcloud.com/vulnerabilities/91203 - http://ww
s://bugzilla.redhat.com/show_bug.cgi?id=1066609 - https://exchange.xforce.ibmcloud.com/vulnerabilities/91203 - http://www.securitytracker.com/id/1029771 - http://samiam.org/blog/2014-02-12.html
CVE ID: CVE-2014-2032 State: PUBLISHED Published: 2018-03-20T21:00:00 Last Updated: 2024-08-06T09:58:16.290Z Vendors: n/a Products: n/a Problem Types: n/a Description: Deadwood before 2.3.09, 3.x before 3.2.05, and as used in MaraDNS before 1.4.14 and 2.x before 2.0.09, allow remote attackers to cause a denial of service (out-of-bounds read and crash) by leveraging permission to perform recursive queries against Deadwood, related to missing input validation. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/65595 - http://www.openwall.com/lists/oss-security/2014/02/19/15 - https://bugzilla.redhat.com/show_bug.cgi?id=1066609 - http://www.securit
openwall.com/lists/oss-security/2014/02/19/15 - https://bugzilla.redhat.com/show_bug.cgi?id=1066609 - http://www.securitytracker.com/id/1029771 - http://samiam.org/blog/2014-02-12.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/91204
CVE ID: CVE-2014-2033 State: PUBLISHED Published: 2014-03-02T17:00:00 Last Updated: 2024-08-06T09:58:16.232Z Vendors: n/a Products: n/a Problem Types: n/a Description: The caching feature in SGOS in Blue Coat ProxySG 5.5 through 5.5.11.3, 6.1 through 6.1.6.3, 6.2 through 6.2.15.3, 6.4 through 6.4.6.1, and 6.3 and 6.5 before 6.5.4 allows remote authenticated users to bypass intended access restrictions during a time window after account deletion or modification by leveraging knowledge of previously valid credentials. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/221620 - https://kb.bluecoat.com/index?page=content&id=SA77
CVE ID: CVE-2014-2034 State: PUBLISHED Published: 2014-04-01T00:00:00 Last Updated: 2024-08-06T09:58:16.268Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in Sonatype Nexus OSS and Pro 2.4.0 through 2.7.1 allows attackers to create arbitrary user accounts via unknown vectors related to "an unauthenticated execution path." Additional Analyst Notes: - CVE Program Container: References: - http://www.sonatype.org/advisories/archive/2014-03-03-Nexus - http://www.osvdb.org/104049 - http://secunia.com/advisories/57142 - http://www.securityfocus.com/bid/65956 - https://support.sonatype.com/entries/42374566-CVE-2014-2034-Nexus-Security-Advisory-REST-API
CVE ID: CVE-2014-2035 State: PUBLISHED Published: 2014-02-27T15:00:00 Last Updated: 2024-08-06T09:58:16.237Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in xhr.php in InterWorx Web Control Panel (aka InterWorx Hosting Control Panel and InterWorx-CP) before 5.0.13 build 574 allows remote attackers to inject arbitrary web script or HTML via the i parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.interworx.com/developers/changelog/version-5-0-13-build-574-2014-02-19 - http://www.securityfocus.com/archive/1/531191/100/0/threaded - http://www.securityfocus.com/bid/65734
CVE ID: CVE-2014-2037 State: PUBLISHED Published: 2014-11-26T15:00:00 Last Updated: 2024-08-06T09:58:16.183Z Vendors: n/a Products: n/a Problem Types: n/a Description: Openswan 2.6.40 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon restart) via IKEv2 packets that lack expected payloads. NOTE: this vulnerability exists because of an incomplete fix for CVE 2013-6466. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2014/02/18/1 - https://lists.openswan.org/pipermail/users/2014-February/022898.html - http://www.openwall.com/lists/oss-security/2014/02/20/2 - http://www.securityfocus.com/bid/6
2014-February/022898.html - http://www.openwall.com/lists/oss-security/2014/02/20/2 - http://www.securityfocus.com/bid/65629
CVE ID: CVE-2014-2038 State: PUBLISHED Published: 2014-02-28T02:00:00 Last Updated: 2024-08-06T09:58:16.169Z Vendors: n/a Products: n/a Problem Types: n/a Description: The nfs_can_extend_write function in fs/nfs/write.c in the Linux kernel before 3.13.3 relies on a write delegation to extend a write operation without a certain up-to-date verification, which allows local users to obtain sensitive information from kernel memory in opportunistic circumstances by writing to a file in an NFS filesystem and then reading the same file. Additional Analyst Notes: - CVE Program Container: References: - http://www.ubuntu.com/usn/USN-2137-1 - http://www.ubuntu.com/usn/USN-2140-1 - https://github.com/tor
iner: References: - http://www.ubuntu.com/usn/USN-2137-1 - http://www.ubuntu.com/usn/USN-2140-1 - https://github.com/torvalds/linux/commit/263b4509ec4d47e0da3e753f85a39ea12d1eff24 - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=263b4509ec4d47e0da3e753f85a39ea12d1eff24 - http://www.openwall.com/lists/oss-security/2014/02/20/16 - http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.3 - https://bugzilla.redhat.com/show_bug.cgi?id=1066939
CVE ID: CVE-2014-2039 State: PUBLISHED Published: 2014-02-28T02:00:00 Last Updated: 2024-08-06T09:58:16.181Z Vendors: n/a Products: n/a Problem Types: n/a Description: arch/s390/kernel/head64.S in the Linux kernel before 3.13.5 on the s390 platform does not properly handle attempted use of the linkage stack, which allows local users to cause a denial of service (system crash) by executing a crafted instruction. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/65700 - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8d7f6690cedb83456edd41c9bd583783f0703bf0 - http://secunia.com/advisories/59262 - http://secunia.com
6.git%3Ba=commit%3Bh=8d7f6690cedb83456edd41c9bd583783f0703bf0 - http://secunia.com/advisories/59262 - http://secunia.com/advisories/59309 - http://linux.oracle.com/errata/ELSA-2014-0771.html - https://bugzilla.redhat.com/show_bug.cgi?id=1067558 - http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.5 - https://github.com/torvalds/linux/commit/8d7f6690cedb83456edd41c9bd583783f0703bf0 - http://www.openwall.com/lists/oss-security/2014/02/20/14
CVE ID: CVE-2014-2040 State: PUBLISHED Published: 2014-03-03T18:00:00 Last Updated: 2024-08-06T09:58:16.286Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the (1) callback_multicheck, (2) callback_radio, and (3) callback_wysiwygin functions in mfrh_class.settings-api.php in the Media File Renamer plugin 1.7.0 for WordPress allow remote authenticated users with permissions to add media or edit media to inject arbitrary web script or HTML via unspecified parameters, as demonstrated by the title of an uploaded file. Additional Analyst Notes: - CVE Program Container: References: - http://www.vapid.dhs.org/advisories/wordpress/pl
file. Additional Analyst Notes: - CVE Program Container: References: - http://www.vapid.dhs.org/advisories/wordpress/plugins/MediaFileRenamer-1.7.0/index.html - http://www.securityfocus.com/archive/1/531270/100/0/threaded - http://www.securityfocus.com/bid/65715
CVE ID: CVE-2014-2042 State: PUBLISHED Published: 2014-04-28T14:00:00 Last Updated: 2024-08-06T09:58:16.311Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted file upload vulnerability in the Manage Project functionality in Livetecs Timelive before 6.5.1 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in a predictable directory in Uploads/. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/531914/100/0/threaded - http://seclists.org/fulldisclosure/2014/Apr/260
CVE ID: CVE-2014-2043 State: PUBLISHED Published: 2014-03-13T14:00:00 Last Updated: 2024-08-06T09:58:16.236Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Resources/System/Templates/Data.aspx in Procentia IntelliPen before 1.1.18.1658 allows remote authenticated users to execute arbitrary SQL commands via the value parameter. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2014/Mar/103 - http://www.securityfocus.com/archive/1/531426/100/0/threaded - https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2043 - http://www.exploit-db.com/exploits/32212
CVE ID: CVE-2014-2044 State: PUBLISHED Published: 2014-10-06T23:00:00 Last Updated: 2024-08-06T09:58:16.206Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incomplete blacklist vulnerability in ajax/upload.php in ownCloud before 5.0, when running on Windows, allows remote authenticated users to bypass intended access restrictions, upload files with arbitrary names, and execute arbitrary code via an Alternate Data Stream (ADS) syntax in the filename parameter, as demonstrated using .htaccess::$DATA to upload a PHP program. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/57267 - http://www.osvdb.org/104082 - http://www.securityfocus.co
Container: References: - http://secunia.com/advisories/57267 - http://www.osvdb.org/104082 - http://www.securityfocus.com/bid/66000 - http://seclists.org/fulldisclosure/2014/Mar/45 - http://packetstormsecurity.com/files/125585/ownCloud-4.0.x-4.5.x-Remote-Code-Execution.html - http://www.exploit-db.com/exploits/32162 - https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2044/ - https://exchange.xforce.ibmcloud.com/vulnerabilities/91757 - http://www.securityfocus.com/archive/1/531365/100/0/threaded
CVE ID: CVE-2014-2045 State: PUBLISHED Published: 2017-01-20T15:00:00 Last Updated: 2024-08-06T09:58:16.327Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the old and new interfaces in Viprinet Multichannel VPN Router 300 allow remote attackers to inject arbitrary web script or HTML via the username when (1) logging in or (2) creating an account in the old interface, (3) username when creating an account in the new interface, (4) hostname in the old interface, (5) inspect parameter in the config module, (6) commands parameter in the atcommands tool, or (7) host parameter in the ping tool. Additional Analyst Notes: - CVE Prog
commands parameter in the atcommands tool, or (7) host parameter in the ping tool. Additional Analyst Notes: - CVE Program Container: References: - https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2045/ - https://www.exploit-db.com/exploits/39407/ - http://www.securityfocus.com/archive/1/537441/100/0/threaded - http://packetstormsecurity.com/files/135613/Viprinet-Multichannel-VPN-Router-300-Cross-Site-Scripting.html - http://seclists.org/fulldisclosure/2016/Feb/8
CVE ID: CVE-2014-2046 State: PUBLISHED Published: 2014-05-14T00:00:00 Last Updated: 2024-08-06T09:58:16.281Z Vendors: n/a Products: n/a Problem Types: n/a Description: cgi-bin/rpcBridge in the web interface 1.1 on Broadcom Ltd PIPA C211 rev2 does not properly restrict access, which allows remote attackers to (1) obtain credentials and other sensitive information via a certain request to the config.getValuesHashExcludePaths method or (2) modify the firmware via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2046/ - http://seclists.org/fulldisclosure/2014/May/
ty.com/security-research-and-downloads/security-advisories/cve-2014-2046/ - http://seclists.org/fulldisclosure/2014/May/58
CVE ID: CVE-2014-2047 State: PUBLISHED Published: 2014-03-14T16:00:00 Last Updated: 2024-08-06T09:58:16.220Z Vendors: n/a Products: n/a Problem Types: n/a Description: Session fixation vulnerability in ownCloud before 6.0.2, when PHP is configured to accept session parameters through a GET request, allows remote attackers to hijack web sessions via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://owncloud.org/about/security/advisories/oC-SA-2014-001/
CVE ID: CVE-2014-2048 State: PUBLISHED Published: 2018-03-26T18:00:00 Last Updated: 2024-08-06T09:58:16.222Z Vendors: n/a Products: n/a Problem Types: n/a Description: The user_openid app in ownCloud Server before 5.0.15 allows remote attackers to obtain access by leveraging an insecure OpenID implementation. Additional Analyst Notes: - CVE Program Container: References: - https://owncloud.org/security/advisories/insecure-openid-implementation/ - https://exchange.xforce.ibmcloud.com/vulnerabilities/91973
CVE ID: CVE-2014-2049 State: PUBLISHED Published: 2014-03-14T16:00:00 Last Updated: 2024-08-06T09:58:16.230Z Vendors: n/a Products: n/a Problem Types: n/a Description: The default Flash Cross Domain policies in ownCloud before 5.0.15 and 6.x before 6.0.2 allows remote attackers to access user files via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://owncloud.org/about/security/advisories/oC-SA-2014-003/
CVE ID: CVE-2014-2050 State: PUBLISHED Published: 2020-01-23T19:07:01 Last Updated: 2024-08-06T09:58:16.177Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2 allows remote attackers to hijack the authentication of users for requests that reset passwords via a crafted HTTP Host header. Additional Analyst Notes: - CVE Program Container: References: - https://owncloud.org/security/advisories/host-header-poisoning/ - https://www.securityfocus.com/bid/66221 - https://exchange.xforce.ibmcloud.com/vulnerabilities/91971
CVE ID: CVE-2014-2051 State: PUBLISHED Published: 2014-06-05T15:00:00 Last Updated: 2024-08-06T09:58:16.289Z Vendors: n/a Products: n/a Problem Types: n/a Description: ownCloud Server before 5.0.15 and 6.0.x before 6.0.2 allows remote attackers to conduct an LDAP injection attack via unspecified vectors, as demonstrated using a "login query." Additional Analyst Notes: - CVE Program Container: References: - http://owncloud.org/about/security/advisories/oC-SA-2014-005/
CVE ID: CVE-2014-2052 State: PUBLISHED Published: 2020-02-11T15:23:46 Last Updated: 2024-08-06T09:58:16.229Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zend Framework, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack. Additional Analyst Notes: - CVE Program Container: References: - http://owncloud.org/about/security/advisories/oC-SA-2014-006/ - https://owncloud.org/security/advisories/xxe-multiple-third-party-components/ - https://www.securityfocus.com/bid/66222
CVE ID: CVE-2014-2053 State: PUBLISHED Published: 2014-06-04T14:00:00 Last Updated: 2024-08-06T09:58:16.348Z Vendors: n/a Products: n/a Problem Types: n/a Description: getID3() before 1.9.8, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2014/dsa-3001 - https://wordpress.org/news/2014/08/wordpress-3-9-2/ - http://getid3.sourceforge.net/source/changelog.txt - http://secunia.com/advisories/58002 - http://owncloud.org/about/security/advis