Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2014-9141 State: PUBLISHED Published: 2014-12-03T01:00:00 Last Updated: 2024-08-06T13:33:13.460Z Vendors: n/a Products: n/a Problem Types: n/a Description: The installer in Thomson Reuters Fixed Assets CS 13.1.4 and earlier uses weak permissions for connectbgdl.exe, which allows local users to execute arbitrary code by modifying this program. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/35423 - http://www.information-paradox.net/2014/12/cve-2014-9141-thomson-reuters-fixed.html
CVE ID: CVE-2014-9142 State: PUBLISHED Published: 2014-12-05T15:00:00 Last Updated: 2024-08-06T13:33:13.436Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Technicolor Router TD5130 with firmware 2.05.C29GV allows remote attackers to inject arbitrary web script or HTML via the failrefer parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/534143/100/0/threaded - http://packetstormsecurity.com/files/129374/ADSL2-2.05.C29GV-XSS-URL-Redirect-Command-Injection.html - http://www.exploit-db.com/exploits/35462
CVE ID: CVE-2014-9143 State: PUBLISHED Published: 2014-12-05T15:00:00 Last Updated: 2024-08-06T13:33:13.652Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open redirect vulnerability in Technicolor Router TD5130 with firmware 2.05.C29GV allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the failrefer parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/534143/100/0/threaded - http://packetstormsecurity.com/files/129374/ADSL2-2.05.C29GV-XSS-URL-Redirect-Command-Injection.html - http://www.exploit-db.com/exploits/35462
CVE ID: CVE-2014-9144 State: PUBLISHED Published: 2014-12-05T15:00:00 Last Updated: 2024-08-06T13:33:13.592Z Vendors: n/a Products: n/a Problem Types: n/a Description: Technicolor Router TD5130 with firmware 2.05.C29GV allows remote attackers to execute arbitrary commands via shell metacharacters in the ping field (setobject_ip parameter). Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/534143/100/0/threaded - http://packetstormsecurity.com/files/129374/ADSL2-2.05.C29GV-XSS-URL-Redirect-Command-Injection.html - http://www.exploit-db.com/exploits/35462
CVE ID: CVE-2014-9145 State: PUBLISHED Published: 2015-04-14T14:00:00 Last Updated: 2024-08-06T13:33:13.508Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in Fiyo CMS 2.0.1.8 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in an edit action to dapur/index.php; (2) cat, (3) user, or (4) level parameter to dapur/apps/app_article/controller/article_list.php; or (5) email parameter in an email action or (6) username parameter in a user action to dapur/apps/app_user/controller/check_user.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/131165/FiyoCMS-2.0.
dditional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/131165/FiyoCMS-2.0.1.8-XSS-SQL-Injection-URL-Bypass.html
CVE ID: CVE-2014-9146 State: PUBLISHED Published: 2015-04-14T14:00:00 Last Updated: 2024-08-06T13:33:13.576Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Fiyo CMS 2.0.1.8 allow remote attackers to inject arbitrary web script or HTML via the (1) view, (2) id, (3) page, or (4) app parameter to the default URI or the (5) act parameter to dapur/index.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/131165/FiyoCMS-2.0.1.8-XSS-SQL-Injection-URL-Bypass.html
CVE ID: CVE-2014-9147 State: PUBLISHED Published: 2017-10-16T15:00:00 Last Updated: 2024-08-06T13:33:13.530Z Vendors: n/a Products: n/a Problem Types: n/a Description: Fiyo CMS 2.0.1.8 allows remote attackers to obtain sensitive information via a direct request to the database backup file in .backup/. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/73437 - http://packetstormsecurity.com/files/131165/FiyoCMS-2.0.1.8-XSS-SQL-Injection-URL-Bypass.html - https://www.exploit-db.com/exploits/36581/
CVE ID: CVE-2014-9148 State: PUBLISHED Published: 2017-10-16T15:00:00 Last Updated: 2024-08-06T13:33:13.525Z Vendors: n/a Products: n/a Problem Types: n/a Description: Fiyo CMS 2.0.1.8 allows remote attackers to bypass intended access restrictions and execute the (1) "Install and Update" or (2) Backup super administrator function via the view parameter in a direct request to fiyo/dapur. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/73437 - http://packetstormsecurity.com/files/131165/FiyoCMS-2.0.1.8-XSS-SQL-Injection-URL-Bypass.html - https://www.exploit-db.com/exploits/36581/
CVE ID: CVE-2014-9150 State: PUBLISHED Published: 2014-11-30T02:00:00 Last Updated: 2024-08-06T13:33:13.595Z Vendors: n/a Products: n/a Problem Types: n/a Description: Race condition in the MoveFileEx call hook feature in Adobe Reader and Acrobat 11.x before 11.0.09 on Windows allows attackers to bypass a sandbox protection mechanism, and consequently write to files in arbitrary locations, via an NTFS junction attack, a similar issue to CVE-2014-0568. Additional Analyst Notes: - CVE Program Container: References: - http://helpx.adobe.com/security/products/reader/apsb14-28.html - https://code.google.com/p/google-security-research/issues/detail?id=103
CVE ID: CVE-2014-9151 State: PUBLISHED Published: 2014-12-01T16:00:00Z Last Updated: 2024-09-17T02:42:05.853Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Services module 7.x-3.x before 7.x-3.10 for Drupal does not properly limit the rate of authentication attempts, which makes it easier for remote attackers to obtain access via a brute-force attack on the administrative password. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/node/2344423 - https://www.drupal.org/node/2344389
CVE ID: CVE-2014-9152 State: PUBLISHED Published: 2014-12-01T16:00:00Z Last Updated: 2024-09-17T03:44:18.701Z Vendors: n/a Products: n/a Problem Types: n/a Description: The _user_resource_create function in the Services module 7.x-3.x before 7.x-3.10 for Drupal uses a password of 1 when creating new user accounts, which makes it easier for remote attackers to guess the password via a brute force attack. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/node/2344423 - http://cgit.drupalcode.org/services/commit/?id=809aafa - https://www.drupal.org/node/2344389
CVE ID: CVE-2014-9153 State: PUBLISHED Published: 2014-12-01T16:00:00Z Last Updated: 2024-09-16T23:42:20.662Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Services module 7.x-3.x before 7.x-3.10 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via the callback parameter in a JSONP response. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/node/2344423 - https://www.drupal.org/node/2344389
CVE ID: CVE-2014-9154 State: PUBLISHED Published: 2014-12-01T16:00:00Z Last Updated: 2024-09-17T03:44:05.984Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Notify module 7.x-1.x before 7.x-1.1 for Drupal does not properly restrict access to (1) new or (2) modified nodes or (3) their fields, which allows remote authenticated users to obtain node titles, teasers, and fields by reading a notification email. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/node/2320741 - https://www.drupal.org/node/2320693
CVE ID: CVE-2014-9155 State: PUBLISHED Published: 2014-12-01T16:00:00Z Last Updated: 2024-09-16T18:43:38.965Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the Avatar Uploader module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.0-beta6 for Drupal allows remote authenticated users to read arbitrary files via a .. (dot dot) in the path of a cropped picture in the uploader panel. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/node/2330763 - https://www.drupal.org/node/2330759 - https://www.drupal.org/node/2332169
CVE ID: CVE-2014-9156 State: PUBLISHED Published: 2014-12-01T16:00:00Z Last Updated: 2024-09-17T02:11:15.931Z Vendors: n/a Products: n/a Problem Types: n/a Description: The FileField module 6.x-3.x before 6.x-3.13 for Drupal does not properly check permissions to view files, which allows remote authenticated users with permission to create or edit content to read private files by attaching an uploaded file. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/node/2304517 - https://www.drupal.org/node/2304561 - http://cgit.drupalcode.org/filefield/commit/?id=3a97fe1
CVE ID: CVE-2014-9157 State: PUBLISHED Published: 2014-12-03T21:00:00 Last Updated: 2024-08-06T13:33:13.457Z Vendors: n/a Products: n/a Problem Types: n/a Description: Format string vulnerability in the yyerror function in lib/cgraph/scan.l in Graphviz allows remote attackers to have unspecified impact via format string specifiers in unknown vectors, which are not properly handled in an error string. Additional Analyst Notes: - CVE Program Container: References: - http://www.mandriva.com/security/advisories?name=MDVSA-2014:248 - https://exchange.xforce.ibmcloud.com/vulnerabilities/98949 - http://www.mandriva.com/security/advisories?name=MDVSA-2015:187 - http://seclists.org/oss-sec/2014/q4/87
ilities/98949 - http://www.mandriva.com/security/advisories?name=MDVSA-2015:187 - http://seclists.org/oss-sec/2014/q4/872 - http://advisories.mageia.org/MGASA-2014-0520.html - http://www.securityfocus.com/bid/71283 - https://github.com/ellson/graphviz/commit/99eda421f7ddc27b14e4ac1d2126e5fe41719081 - http://www.debian.org/security/2014/dsa-3098 - http://secunia.com/advisories/60166 - http://seclists.org/oss-sec/2014/q4/784
CVE ID: CVE-2014-9158 State: PUBLISHED Published: 2014-12-10T21:00:00 Last Updated: 2024-08-06T13:33:13.684Z Vendors: n/a Products: n/a Problem Types: n/a Description: Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-8445, CVE-2014-8446, CVE-2014-8447, CVE-2014-8456, CVE-2014-8458, CVE-2014-8459, and CVE-2014-8461. Additional Analyst Notes: - CVE Program Container: References: - http://helpx.adobe.com/security/products/reader/apsb14-28.html
CVE ID: CVE-2014-9159 State: PUBLISHED Published: 2014-12-10T21:00:00 Last Updated: 2024-08-06T13:33:13.513Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-8457 and CVE-2014-8460. Additional Analyst Notes: - CVE Program Container: References: - http://helpx.adobe.com/security/products/reader/apsb14-28.html
CVE ID: CVE-2014-9160 State: PUBLISHED Published: 2015-05-13T10:00:00 Last Updated: 2024-08-06T13:33:13.496Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple heap-based buffer overflows in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to execute arbitrary code via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - https://helpx.adobe.com/security/products/reader/apsb15-10.html - http://www.securitytracker.com/id/1032284
CVE ID: CVE-2014-9161 State: PUBLISHED Published: 2015-01-30T11:00:00 Last Updated: 2024-08-06T13:33:13.538Z Vendors: n/a Products: n/a Problem Types: n/a Description: CoolType.dll in Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows, and 10.x through 10.1.13 and 11.x through 11.0.10 on OS X, allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted PDF document. Additional Analyst Notes: - CVE Program Container: References: - http://code.google.com/p/google-security-research/issues/detail?id=149 - https://helpx.adobe.com/security/products/reader/apsb15-10.html - http://www.securityfocus.com
ch/issues/detail?id=149 - https://helpx.adobe.com/security/products/reader/apsb15-10.html - http://www.securityfocus.com/bid/74600 - http://www.securitytracker.com/id/1032284 - http://packetstormsecurity.com/files/134394/Adobe-Reader-X-XI-Out-Of-Bounds-Read.html
CVE ID: CVE-2014-9162 State: PUBLISHED Published: 2014-12-10T21:00:00 Last Updated: 2024-08-06T13:33:13.480Z Vendors: n/a Products: n/a Problem Types: n/a Description: Adobe Flash Player before 13.0.0.259 and 14.x through 16.x before 16.0.0.235 on Windows and OS X and before 11.2.202.425 on Linux allows attackers to obtain sensitive information via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://helpx.adobe.com/security/products/flash-player/apsb14-27.html
CVE ID: CVE-2014-9163 State: PUBLISHED Published: 2014-12-10T21:00:00.000Z Last Updated: 2025-11-17T20:12:40.464Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in Adobe Flash Player before 13.0.0.259 and 14.x and 15.x before 15.0.0.246 on Windows and OS X and before 11.2.202.425 on Linux allows attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in December 2014. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://helpx.adobe.com/security/products/flash-player/apsb14-27.html
CVE ID: CVE-2014-9164 State: PUBLISHED Published: 2014-12-10T21:00:00 Last Updated: 2024-08-06T13:33:13.611Z Vendors: n/a Products: n/a Problem Types: n/a Description: Adobe Flash Player before 13.0.0.259 and 14.x through 16.x before 16.0.0.235 on Windows and OS X and before 11.2.202.425 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0587. Additional Analyst Notes: - CVE Program Container: References: - http://helpx.adobe.com/security/products/flash-player/apsb14-27.html
CVE ID: CVE-2014-9165 State: PUBLISHED Published: 2014-12-10T21:00:00 Last Updated: 2024-08-06T13:33:13.543Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-8454 and CVE-2014-8455. Additional Analyst Notes: - CVE Program Container: References: - http://helpx.adobe.com/security/products/reader/apsb14-28.html
CVE ID: CVE-2014-9166 State: PUBLISHED Published: 2014-12-10T21:00:00 Last Updated: 2024-08-06T13:33:13.506Z Vendors: n/a Products: n/a Problem Types: n/a Description: Adobe ColdFusion 10 before Update 15 and 11 before Update 3 allows attackers to cause a denial of service (resource consumption) via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://helpx.adobe.com/security/products/coldfusion/apsb14-29.html
CVE ID: CVE-2014-9167 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2014-9168 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2014-9169 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2014-9170 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2014-9171 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2014-9172 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2014-9173 State: PUBLISHED Published: 2014-12-02T16:00:00 Last Updated: 2024-08-06T13:33:13.470Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in view.php in the Google Doc Embedder plugin before 2.5.15 for WordPress allows remote attackers to execute arbitrary SQL commands via the gpid parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/98944 - https://plugins.trac.wordpress.org/changeset/1023572/google-document-embedder - http://security.szurek.pl/google-doc-embedder-2514-sql-injection.html - http://www.exploit-db.com/exploits/35371 - http://osvdb.org/show/osvdb
.pl/google-doc-embedder-2514-sql-injection.html - http://www.exploit-db.com/exploits/35371 - http://osvdb.org/show/osvdb/115044
CVE ID: CVE-2014-9174 State: PUBLISHED Published: 2014-12-02T16:00:00 Last Updated: 2024-08-06T13:33:13.612Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Google Analytics by Yoast (google-analytics-for-wordpress) plugin before 5.1.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the "Manually enter your UA code" (manual_ua_code_field) field in the General Settings. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/7692 - https://exchange.xforce.ibmcloud.com/vulnerabilities/99053 - http://www.securityfocus.com/bid/71330 - https://twitter.com/yoast
/exchange.xforce.ibmcloud.com/vulnerabilities/99053 - http://www.securityfocus.com/bid/71330 - https://twitter.com/yoast/status/537569224307511296 - https://wordpress.org/plugins/google-analytics-for-wordpress/changelog/
CVE ID: CVE-2014-9175 State: PUBLISHED Published: 2014-12-02T16:00:00 Last Updated: 2024-08-06T13:33:13.506Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in wpdatatables.php in the wpDataTables plugin 1.5.3 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the table_id parameter in a get_wdtable action to wp-admin/admin-ajax.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/71271 - http://www.homelab.it/index.php/2014/11/23/wordpress-wpdatatables-sql-injection-vulnerability - https://exchange.xforce.ibmcloud.com/vulnerabilities/98928 - http://www.exploit-db.com
les-sql-injection-vulnerability - https://exchange.xforce.ibmcloud.com/vulnerabilities/98928 - http://www.exploit-db.com/exploits/35340 - http://packetstormsecurity.com/files/129232/WordPress-wpDataTables-1.5.3-SQL-Injection.html
CVE ID: CVE-2014-9176 State: PUBLISHED Published: 2014-12-02T16:00:00 Last Updated: 2024-08-06T13:33:13.651Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the InstaSqueeze Sexy Squeeze Pages plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter to lp/index.php. Additional Analyst Notes: - CVE Program Container: References: - http://h4x0resec.blogspot.com/2014/11/wordpress-sexy-squeeze-pages-plugin.html - http://packetstormsecurity.com/files/129285/WordPress-Sexy-Squeeze-Pages-Cross-Site-Scripting.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/98986
CVE ID: CVE-2014-9177 State: PUBLISHED Published: 2014-12-02T16:00:00 Last Updated: 2024-08-06T13:33:13.648Z Vendors: n/a Products: n/a Problem Types: n/a Description: The HTML5 MP3 Player with Playlist Free plugin before 2.7 for WordPress allows remote attackers to obtain the installation path via a request to html5plus/playlist.php. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/html5-mp3-player-with-playlist/changelog/ - http://h4x0resec.blogspot.com/2014/11/wordpress-html5-mp3-player-with.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/98988 - http://packetstormsecurity.com/files/129286/WordPress-Html5-Mp3-Player-Full-Path-Discl
cloud.com/vulnerabilities/98988 - http://packetstormsecurity.com/files/129286/WordPress-Html5-Mp3-Player-Full-Path-Disclosure.html
CVE ID: CVE-2014-9178 State: PUBLISHED Published: 2014-12-02T16:00:00 Last Updated: 2024-08-06T13:33:13.651Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in classes/ajax.php in the Smarty Pants Plugins SP Project & Document Manager plugin (sp-client-document-manager) 2.4.1 and earlier for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) vendor_email[] parameter in the email_vendor function or id parameter in the (2) download_project, (3) download_archive, or (4) remove_cat function. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/35313 - http://www.itas.vn/ne
l Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/35313 - http://www.itas.vn/news/itas-team-phat-hien-nhieu-lo-hong-sql-injection-trong-sp-client-document-manager-plugin-67.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/98897 - http://www.securityfocus.com/archive/1/534041/100/0/threaded - http://packetstormsecurity.com/files/129212/WordPress-SP-Client-Document-Manager-2.4.1-SQL-Injection.html
CVE ID: CVE-2014-9179 State: PUBLISHED Published: 2014-12-02T16:00:00Z Last Updated: 2024-09-16T16:23:27.587Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the SupportEzzy Ticket System plugin 1.2.5 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the "URL (optional)" field in a new ticket. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/129103/WordPress-SupportEzzy-Ticket-System-1.2.5-Cross-Site-Scripting.html
CVE ID: CVE-2014-9180 State: PUBLISHED Published: 2014-12-02T16:00:00Z Last Updated: 2024-09-16T19:29:54.876Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open redirect vulnerability in go.php in Eleanor CMS allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the QUERY_STRING. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/129087/Eleanor-CMS-Open-Redirect.html
CVE ID: CVE-2014-9181 State: PUBLISHED Published: 2014-12-02T16:00:00Z Last Updated: 2024-09-17T00:46:37.375Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple directory traversal vulnerabilities in Plex Media Server before 0.9.9.3 allow remote attackers to read arbitrary files via a .. (dot dot) in the URI to (1) manage/ or (2) web/ or remote authenticated users to read arbitrary files via a .. (dot dot) in the URI to resources/. Additional Analyst Notes: - CVE Program Container: References: - https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140228-1_Plex_Media_Server_Authentication_bypass_local_file_disclosure_v10.txt - http://www.securityfocus.com
ries_txt/20140228-1_Plex_Media_Server_Authentication_bypass_local_file_disclosure_v10.txt - http://www.securityfocus.com/archive/1/531290 - https://forums.plex.tv/index.php/topic/62832-plex-media-server/?p=583250
CVE ID: CVE-2014-9182 State: PUBLISHED Published: 2014-12-02T18:00:00Z Last Updated: 2024-09-16T17:28:44.632Z Vendors: n/a Products: n/a Problem Types: n/a Description: models/comment.php in Anchor CMS 0.9.2 and earlier allows remote attackers to inject arbitrary headers into mail messages via a crafted Host: header. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/129042/Anchor-CMS-0.9.2-Header-Injection.html