Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2014-3984 State: PUBLISHED Published: 2014-06-06T14:00:00 Last Updated: 2024-08-06T11:04:26.954Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple unspecified vulnerabilities in Libav before 0.8.12 allow remote attackers to have unknown impact and vectors. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/59032 - http://www.ubuntu.com/usn/USN-2244-1 - http://git.libav.org/?p=libav.git%3Ba=blob%3Bf=Changelog%3Bhb=refs/tags/v0.8.12 - http://secunia.com/advisories/59045 - http://www.debian.org/security/2014/dsa-2947 - http://libav.org/news.html
CVE ID: CVE-2014-3985 State: PUBLISHED Published: 2014-09-11T18:00:00 Last Updated: 2024-08-06T11:04:27.696Z Vendors: n/a Products: n/a Problem Types: n/a Description: The getHTTPResponse function in miniwget.c in MiniUPnP 1.9 allows remote attackers to cause a denial of service (crash) via crafted headers that trigger an out-of-bounds read. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/67152 - http://lists.opensuse.org/opensuse-updates/2014-06/msg00039.html - https://security.gentoo.org/glsa/201701-41 - https://github.com/miniupnp/miniupnp/commit/3a87aa2f10bd7f1408e1849bdb59c41dd63a9fe9 - http://seclists.org/oss-sec/2014/q2/201 - https://b
/miniupnp/miniupnp/commit/3a87aa2f10bd7f1408e1849bdb59c41dd63a9fe9 - http://seclists.org/oss-sec/2014/q2/201 - https://bugzilla.redhat.com/show_bug.cgi?id=1085618 - http://seclists.org/oss-sec/2014/q2/496
CVE ID: CVE-2014-3986 State: PUBLISHED Published: 2014-06-08T18:00:00 Last Updated: 2024-08-06T11:04:27.801Z Vendors: n/a Products: n/a Problem Types: n/a Description: include/tests_webservers in Lynis before 1.5.5 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/lynis.*.unsorted file with an easily determined name. Additional Analyst Notes: - CVE Program Container: References: - http://cisofy.com/files/lynis-1.5.5.tar.gz - http://openwall.com/lists/oss-security/2014/06/07/3 - http://openwall.com/lists/oss-security/2014/06/05/14 - http://seclists.org/fulldisclosure/2014/Jun/21 - http://openwall.com/lists/oss-security/2014/06/06/12
CVE ID: CVE-2014-3988 State: PUBLISHED Published: 2014-12-03T01:00:00 Last Updated: 2024-08-06T11:04:28.121Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in index.php in SunHater KCFinder 3.11 and earlier allows remote attackers to inject arbitrary web script or HTML via (1) file or (2) directory (folder) name of an uploaded file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sunhater/kcfinder/issues/40
CVE ID: CVE-2014-3990 State: PUBLISHED Published: 2018-03-20T21:00:00 Last Updated: 2024-08-06T11:04:26.934Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Cart::getProducts method in system/library/cart.php in OpenCart 1.5.6.4 and earlier allows remote attackers to conduct server-side request forgery (SSRF) attacks or possibly conduct XML External Entity (XXE) attacks and execute arbitrary code via a crafted serialized PHP object, related to the quantity parameter in an update request. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/532763/100/0/threaded - https://github.com/opencart-ce/opencart-ce/commit/c2aafc823bd858
www.securityfocus.com/archive/1/532763/100/0/threaded - https://github.com/opencart-ce/opencart-ce/commit/c2aafc823bd85876f5e888f8ebc421069a5e076f - http://seclists.org/fulldisclosure/2014/Jul/67 - http://karmainsecurity.com/KIS-2014-08 - http://packetstormsecurity.com/files/127460/OpenCart-1.5.6.4-PHP-Object-Injection.html - http://www.securityfocus.com/bid/68529
CVE ID: CVE-2014-3991 State: PUBLISHED Published: 2014-07-11T14:00:00 Last Updated: 2024-08-06T11:04:26.962Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.5.3 allow remote attackers to inject arbitrary web script or HTML via the (1) dol_use_jmobile, (2) dol_optimize_smallscreen, (3) dol_no_mouse_hover, (4) dol_hide_topmenu, (5) dol_hide_leftmenu, (6) mainmenu, or (7) leftmenu parameter to index.php; the (8) dol_use_jmobile, (9) dol_optimize_smallscreen, (10) dol_no_mouse_hover, (11) dol_hide_topmenu, or (12) dol_hide_leftmenu parameter to user/index.php; the (13) dol_use_jmobile, (14) dol_optimize_smallscr
ide_topmenu, or (12) dol_hide_leftmenu parameter to user/index.php; the (13) dol_use_jmobile, (14) dol_optimize_smallscreen, (15) dol_no_mouse_hover, (16) dol_hide_topmenu, or (17) dol_hide_leftmenu parameter to user/logout.php; the (18) email, (19) firstname, (20) job, (21) lastname, or (22) login parameter in an update action in a "User Card" to user/fiche.php; or the (23) modulepart or (24) file parameter to viewimage.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/127389/Dolibarr-CMS-3.5.3-SQL-Injection-Cross-Site-Scripting.html
CVE ID: CVE-2014-3992 State: PUBLISHED Published: 2014-07-11T14:00:00 Last Updated: 2024-08-06T11:04:26.936Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM 3.5.3 allow remote authenticated users to execute arbitrary SQL commands via the (1) entity parameter in an update action to user/fiche.php or (2) sortorder parameter to user/group/index.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/127389/Dolibarr-CMS-3.5.3-SQL-Injection-Cross-Site-Scripting.html
CVE ID: CVE-2014-3994 State: PUBLISHED Published: 2014-06-16T18:00:00 Last Updated: 2024-08-06T11:04:26.954Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in util/templatetags/djblets_js.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django, as used in Review Board, allows remote attackers to inject arbitrary web script or HTML via a JSON object, as demonstrated by the name field when changing a user name. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/oss-sec/2014/q2/494 - http://seclists.org/oss-sec/2014/q2/498 - http://www.securityfocus.com/bid/67932 - https://code.google.com/p/reviewboard/
ttp://seclists.org/oss-sec/2014/q2/498 - http://www.securityfocus.com/bid/67932 - https://code.google.com/p/reviewboard/issues/detail?id=3406 - https://github.com/djblets/djblets/commit/77a68c03cd619a0996f3f37337b8c39ca6643d6e - http://secunia.com/advisories/58691 - https://github.com/djblets/djblets/commit/e2c79117efd925636acd871a5f473512602243cf - https://github.com/djblets/djblets/commit/50000d0bbb983fa8c097b588d06b64df8df483bd
CVE ID: CVE-2014-3995 State: PUBLISHED Published: 2014-06-16T18:00:00 Last Updated: 2024-08-06T11:04:26.958Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in gravatars/templatetags/gravatars.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django allows remote attackers to inject arbitrary web script or HTML via a user display name. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/oss-sec/2014/q2/494 - http://seclists.org/oss-sec/2014/q2/498 - https://github.com/djblets/djblets/commit/77ac64642ad530bf69e390c51fc6fdcb8914c8e7 - http://secunia.com/advisories/58691 - https://github.com/djblets/djblet
ommit/77ac64642ad530bf69e390c51fc6fdcb8914c8e7 - http://secunia.com/advisories/58691 - https://github.com/djblets/djblets/commit/e2c79117efd925636acd871a5f473512602243cf - https://github.com/djblets/djblets/commit/50000d0bbb983fa8c097b588d06b64df8df483bd
CVE ID: CVE-2014-3996 State: PUBLISHED Published: 2014-12-05T15:00:00 Last Updated: 2024-08-06T11:04:26.925Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the LinkViewFetchServlet servlet in ManageEngine Desktop Central (DC) and Desktop Central Managed Service Providers (MSP) edition before 9 build 90043, Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edition before 7 build 7003, IT360 and IT360 Managed Service Providers (MSP) edition before 10.3.3 build 10330, and possibly other ManageEngine products, allows remote attackers or remote authenticated users to execute arbitrary SQL commands via the sv parameter to
roducts, allows remote attackers or remote authenticated users to execute arbitrary SQL commands via the sv parameter to LinkViewFetchServlet.dat. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2014/Aug/55 - http://www.securityfocus.com/bid/69305 - https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_dc_pmp_it360_sqli.txt - https://raw.githubusercontent.com/pedrib/PoC/master/msf_modules/manageengine_dc_pmp_sqli.rb - http://packetstormsecurity.com/files/127973/ManageEngine-Password-Manager-MetadataServlet.dat-SQL-Injection.html - http://seclists.org/fulldisclosure/2014/Aug/85
CVE ID: CVE-2014-3997 State: PUBLISHED Published: 2014-12-05T15:00:00 Last Updated: 2024-08-06T11:04:27.709Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the MetadataServlet servlet in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edition 5 through 7 build 7003, IT360 and IT360 Managed Service Providers (MSP) edition before 10.3.3 build 10330, and possibly other ManageEngine products, allows remote attackers or remote authenticated users to execute arbitrary SQL commands via the sv parameter to MetadataServlet.dat. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.or
sv parameter to MetadataServlet.dat. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2014/Aug/55 - https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_dc_pmp_it360_sqli.txt - https://raw.githubusercontent.com/pedrib/PoC/master/msf_modules/manageengine_dc_pmp_sqli.rb - http://seclists.org/fulldisclosure/2014/Aug/85
CVE ID: CVE-2014-3999 State: PUBLISHED Published: 2018-04-10T15:00:00 Last Updated: 2024-08-06T11:04:28.271Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Horde_Ldap library before 2.0.6 for Horde allows remote attackers to bypass authentication by leveraging knowledge of the LDAP bind user DN. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2014/06/14/1 - https://bugzilla.redhat.com/show_bug.cgi?id=1109628 - https://github.com/horde/horde/commit/4c3e18f1724ab39bfef10c189a5b52036a744d55 - http://www.securityfocus.com/bid/68014 - https://marc.info/?l=horde-announce&m=140178644816474&w=2
CVE ID: CVE-2014-456132 State: REJECTED Published: 2015-01-13T11:00:00 Last Updated: 2016-04-26T12:57:01 Description: No description available.
CVE ID: CVE-2014-4000 State: PUBLISHED Published: 2017-11-15T16:00:00 Last Updated: 2024-08-06T11:04:28.200Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cacti before 1.0.0 allows remote authenticated users to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object, related to calling unserialize(stripslashes()). Additional Analyst Notes: - CVE Program Container: References: - https://security-tracker.debian.org/tracker/CVE-2014-4000 - https://forums.cacti.net/viewtopic.php?f=4&t=56794 - https://security.gentoo.org/glsa/201711-10 - https://www.cacti.net/release_notes_1_0_0.php
CVE ID: CVE-2014-4002 State: PUBLISHED Published: 2014-07-03T14:00:00 Last Updated: 2024-08-06T11:04:27.981Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.8b allow remote attackers to inject arbitrary web script or HTML via the (1) drp_action parameter to cdef.php, (2) data_input.php, (3) data_queries.php, (4) data_sources.php, (5) data_templates.php, (6) graph_templates.php, (7) graphs.php, (8) host.php, or (9) host_templates.php or the (10) graph_template_input_id or (11) graph_template_id parameter to graph_templates_inputs.php. Additional Analyst Notes: - CVE Program Container: References: - http://svn.cacti.ne
eter to graph_templates_inputs.php. Additional Analyst Notes: - CVE Program Container: References: - http://svn.cacti.net/viewvc?view=rev&revision=7452 - http://svn.cacti.net/viewvc?view=rev&revision=7451 - http://secunia.com/advisories/59203 - http://lists.opensuse.org/opensuse-updates/2015-03/msg00034.html - http://www.securityfocus.com/bid/68257 - http://www.debian.org/security/2014/dsa-2970 - https://security.gentoo.org/glsa/201509-03 - http://secunia.com/advisories/59517
CVE ID: CVE-2014-4003 State: PUBLISHED Published: 2014-06-09T20:00:00 Last Updated: 2024-08-06T11:04:28.167Z Vendors: n/a Products: n/a Problem Types: n/a Description: The System Landscape Directory (SLD) in SAP NetWeaver allows remote attackers to modify information via vectors related to adding a system. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/126986/SAP-SLD-Information-Tampering.html - http://www.securityfocus.com/archive/1/532331/100/0/threaded - http://seclists.org/fulldisclosure/2014/Jun/37 - http://www.securityfocus.com/bid/67923 - http://scn.sap.com/docs/DOC-8218 - http://secunia.com/advisories/58633 - https://service.sap.
urityfocus.com/bid/67923 - http://scn.sap.com/docs/DOC-8218 - http://secunia.com/advisories/58633 - https://service.sap.com/sap/support/notes/1939334
CVE ID: CVE-2014-4004 State: PUBLISHED Published: 2014-06-09T20:00:00 Last Updated: 2024-08-06T11:04:28.423Z Vendors: n/a Products: n/a Problem Types: n/a Description: The (1) Structures and (2) Project-Oriented Procurement components in SAP Project System has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/67920 - http://www.layersevensecurity.com/docs/Layer%20Seven%20Security_Advisory_February%202014.pdf - http://seclists.org/fulldisclosure/2014/Jun/36 - http://scn.sap.com/docs/DOC-8218 - https://service.sap.com/sap/support/notes/1791
lists.org/fulldisclosure/2014/Jun/36 - http://scn.sap.com/docs/DOC-8218 - https://service.sap.com/sap/support/notes/1791081
CVE ID: CVE-2014-4005 State: PUBLISHED Published: 2014-06-09T20:00:00 Last Updated: 2024-08-06T11:04:27.929Z Vendors: n/a Products: n/a Problem Types: n/a Description: SAP Brazil add-on has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/67920 - https://service.sap.com/sap/support/notes/1768049 - http://www.layersevensecurity.com/docs/Layer%20Seven%20Security_Advisory_February%202014.pdf - http://seclists.org/fulldisclosure/2014/Jun/36 - http://scn.sap.com/docs/DOC-8218
CVE ID: CVE-2014-4006 State: PUBLISHED Published: 2014-06-09T20:00:00 Last Updated: 2024-08-06T11:04:28.197Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SAP Trader's and Scheduler's Workbench (TSW) for SAP Oil & Gas has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/67920 - http://www.layersevensecurity.com/docs/Layer%20Seven%20Security_Advisory_February%202014.pdf - http://seclists.org/fulldisclosure/2014/Jun/36 - http://scn.sap.com/docs/DOC-8218 - https://service.sap.com/sap/support/notes/1920323
CVE ID: CVE-2014-4007 State: PUBLISHED Published: 2014-06-09T20:00:00 Last Updated: 2024-08-06T11:04:28.346Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SAP Upgrade tools for ABAP has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/67920 - https://service.sap.com/sap/support/notes/1915873 - http://seclists.org/fulldisclosure/2014/Jun/36 - http://scn.sap.com/docs/DOC-8218
CVE ID: CVE-2014-4008 State: PUBLISHED Published: 2014-06-09T20:00:00 Last Updated: 2024-08-06T11:04:27.917Z Vendors: n/a Products: n/a Problem Types: n/a Description: SAP Web Services Tool (CA-WUI-WST) has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/67920 - https://service.sap.com/sap/support/notes/1914777 - http://seclists.org/fulldisclosure/2014/Jun/36 - http://scn.sap.com/docs/DOC-8218
CVE ID: CVE-2014-4009 State: PUBLISHED Published: 2014-06-09T20:00:00 Last Updated: 2024-08-06T11:04:27.612Z Vendors: n/a Products: n/a Problem Types: n/a Description: SAP CCMS Monitoring (BC-CCM-MON) has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/67920 - https://service.sap.com/sap/support/notes/1911174 - http://seclists.org/fulldisclosure/2014/Jun/36 - http://scn.sap.com/docs/DOC-8218
CVE ID: CVE-2014-4010 State: PUBLISHED Published: 2014-06-09T20:00:00 Last Updated: 2024-08-06T11:04:27.824Z Vendors: n/a Products: n/a Problem Types: n/a Description: SAP Transaction Data Pool has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/67920 - https://service.sap.com/sap/support/notes/1795463 - http://seclists.org/fulldisclosure/2014/Jun/36 - http://scn.sap.com/docs/DOC-8218
CVE ID: CVE-2014-4011 State: PUBLISHED Published: 2014-06-09T20:00:00 Last Updated: 2024-08-06T11:04:28.113Z Vendors: n/a Products: n/a Problem Types: n/a Description: SAP Capacity Leveling has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/67920 - http://seclists.org/fulldisclosure/2014/Jun/36 - http://scn.sap.com/docs/DOC-8218 - https://service.sap.com/sap/support/notes/1789569
CVE ID: CVE-2014-4012 State: PUBLISHED Published: 2014-06-09T20:00:00 Last Updated: 2024-08-06T11:04:27.718Z Vendors: n/a Products: n/a Problem Types: n/a Description: SAP Open Hub Service has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/67920 - https://service.sap.com/sap/support/notes/1738965 - http://seclists.org/fulldisclosure/2014/Jun/36 - http://scn.sap.com/docs/DOC-8218
CVE ID: CVE-2014-4013 State: PUBLISHED Published: 2014-07-14T14:00:00 Last Updated: 2024-08-06T11:04:27.758Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the Policy Manager in Aruba Networks ClearPass 5.x, 6.0.x, 6.1.x through 6.1.4.61696, 6.2.x through 6.2.6.62196, and 6.3.x before 6.3.4 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.arubanetworks.com/support/alerts/aid-07032014.txt - http://secunia.com/advisories/58936
CVE ID: CVE-2014-4014 State: PUBLISHED Published: 2014-06-23T10:00:00 Last Updated: 2024-08-06T11:04:28.054Z Vendors: n/a Products: n/a Problem Types: n/a Description: The capabilities implementation in the Linux kernel before 3.14.8 does not properly consider that namespaces are inapplicable to inodes, which allows local users to bypass intended chmod restrictions by first creating a user namespace, as demonstrated by setting the setgid bit on a file with group ownership of root. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/67988 - https://source.android.com/security/bulletin/2016-12-01.html - http://www.securitytracker.com/id/1030394 - h
bid/67988 - https://source.android.com/security/bulletin/2016-12-01.html - http://www.securitytracker.com/id/1030394 - http://www.exploit-db.com/exploits/33824 - http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.8 - https://github.com/torvalds/linux/commit/23adbe12ef7d3d4195e80800ab36b37bee28cd03 - http://secunia.com/advisories/59220 - https://bugzilla.redhat.com/show_bug.cgi?id=1107966 - http://www.openwall.com/lists/oss-security/2014/06/10/4 - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=23adbe12ef7d3d4195e80800ab36b37bee28cd03
CVE ID: CVE-2014-4017 State: PUBLISHED Published: 2014-06-10T14:00:00Z Last Updated: 2024-09-16T16:58:24.118Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Conversion Ninja plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter to lp/index.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/126781/WordPress-Conversion-Ninja-Cross-Site-Scripting.html
CVE ID: CVE-2014-4018 State: PUBLISHED Published: 2014-07-16T14:00:00 Last Updated: 2024-08-06T11:04:27.949Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ZTE ZXV10 W300 router with firmware W300V1.0.0a_ZRD_LK has a default password of admin for the admin account, which makes it easier for remote attackers to obtain access via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/127129/ZTE-WXV10-W300-Disclosure-CSRF-Default.html - https://osandamalith.wordpress.com/2014/06/15/zte-wxv10-w300-multiple-vulnerabilities/ - http://www.exploit-db.com/exploits/33803
CVE ID: CVE-2014-4019 State: PUBLISHED Published: 2020-02-20T17:27:39 Last Updated: 2024-08-06T11:04:27.601Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZTE ZXV10 W300 router with firmware W300V1.0.0a_ZRD_LK stores sensitive information under the web root with insufficient access control, which allows remote attackers to read backup files via a direct request for rom-0. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/127129/ZTE-WXV10-W300-Disclosure-CSRF-Default.html - https://osandamalith.wordpress.com/2014/06/15/zte-wxv10-w300-multiple-vulnerabilities/ - http://www.exploit-db.com/exploits/33803 - http://www.osvdb.org/1026
14/06/15/zte-wxv10-w300-multiple-vulnerabilities/ - http://www.exploit-db.com/exploits/33803 - http://www.osvdb.org/102668
CVE ID: CVE-2014-4020 State: PUBLISHED Published: 2014-06-18T16:00:00 Last Updated: 2024-08-06T11:04:27.968Z Vendors: n/a Products: n/a Problem Types: n/a Description: The dissect_frame function in epan/dissectors/packet-frame.c in the frame metadissector in Wireshark 1.10.x before 1.10.8 interprets a negative integer as a length value even though it was intended to represent an error condition, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10030 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9999 - http://lists.ope
reshark.org/bugzilla/show_bug.cgi?id=10030 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9999 - http://lists.opensuse.org/opensuse-updates/2014-06/msg00049.html - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=beb119f911a698d44f4baa06d888bb1e775983bc - http://www.wireshark.org/security/wnpa-sec-2014-07.html