rainbutterfly/cve_corpus huggingface dataset:
CVE-2014-9623 
OpenStack Glance 2014.2.x through 2014.2.1, 2014.1.3, and earlier allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting an image in the saving state.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-23T15:00:00.000Z
CVE-2014-9624 
CAPTCHA bypass vulnerability in MantisBT before 1.2.19.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-12T14:00:00.000Z
CVE-2014-9625 
The GetUpdateFile function in misc/update.c in the Updater in VideoLAN VLC media player before 2.1.6 performs an incorrect cast operation from a 64-bit integer to a 32-bit integer, which allows remote attackers to conduct buffer overflow attacks and execute arbitrary code via a crafted update status file, aka an "integer truncation" vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-24T21:57:29.000Z
CVE-2014-9626 
Integer underflow in the MP4_ReadBox_String function in modules/demux/mp4/libmp4.c in VideoLAN VLC media player before 2.1.6 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a box size less than 7.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-24T21:57:25.000Z
CVE-2014-9627 
The MP4_ReadBox_String function in modules/demux/mp4/libmp4.c in VideoLAN VLC media player before 2.1.6 performs an incorrect cast operation from a 64-bit integer to a 32-bit integer, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large box size.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-24T21:57:23.000Z
CVE-2014-9628 
The MP4_ReadBox_String function in modules/demux/mp4/libmp4.c in VideoLAN VLC media player before 2.1.6 allows remote attackers to trigger an unintended zero-size malloc and conduct buffer overflow attacks, and consequently execute arbitrary code, via a box size of 7.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-24T21:57:20.000Z
CVE-2014-9629 
Integer overflow in the Encode function in modules/codec/schroedinger.c in VideoLAN VLC media player before 2.1.6 and 2.2.x before 2.2.1 allows remote attackers to conduct buffer overflow attacks and execute arbitrary code via a crafted length value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-24T21:57:17.000Z
CVE-2014-9630 
The rtp_packetize_xiph_config function in modules/stream_out/rtpfmt.c in VideoLAN VLC media player before 2.1.6 uses a stack-allocation approach with a size determined by arbitrary input data, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted length value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-24T21:57:14.000Z
CVE-2014-9632 
The TDI driver (avgtdix.sys) in AVG Internet Security before 2013.3495 Hot Fix 18 and 2015.x before 2015.5315 and Protection before 2015.5315 allows local users to write to arbitrary memory locations, and consequently gain privileges, via a crafted 0x830020f8 IOCTL call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-06T15:00:00.000Z
CVE-2014-9633 
The bdisk.sys driver in COMODO Backup before 4.4.1.23 allows remote attackers to gain privileges via a crafted device handle, which triggers a NULL pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-03T16:00:00.000Z
CVE-2014-9634 
Jenkins before 1.586 does not set the secure flag on session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote attackers to capture cookies by intercepting their transmission within an HTTP session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-12T14:00:00.000Z
CVE-2014-9635 
Jenkins before 1.586 does not set the HttpOnly flag in a Set-Cookie header for session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote attackers to obtain potentially sensitive information via script access to cookies.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-12T14:00:00.000Z
CVE-2014-9636 
unzip 6.0 allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) via an extra field with an uncompressed size smaller than the compressed field size in a zip archive that advertises STORED method compression.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-06T15:00:00.000Z
CVE-2014-9637 
GNU patch 2.7.2 and earlier allows remote attackers to cause a denial of service (memory consumption and segmentation fault) via a crafted diff file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-25T18:00:00.000Z
CVE-2014-9638 
oggenc in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (divide-by-zero error and crash) via a WAV file with the number of channels set to zero.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-23T15:00:00.000Z
CVE-2014-9639 
Integer overflow in oggenc in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (crash) via a crafted number of channels in a WAV file, which triggers an out-of-bounds memory access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-23T15:00:00.000Z
CVE-2014-9640 
oggenc/oggenc.c in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted raw file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-23T15:00:00.000Z
CVE-2014-9641 
The tmeext.sys driver before 2.0.0.1015 in Trend Micro Antivirus Plus, Internet Security, and Maximum Security allows local users to write to arbitrary memory locations, and consequently gain privileges, via a crafted 0x00222400 IOCTL call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-06T15:00:00.000Z
CVE-2014-9642 
bdagent.sys in BullGuard Antivirus, Internet Security, Premium Protection, and Online Backup before 15.0.288 allows local users to write data to arbitrary memory locations, and consequently gain privileges, via a crafted 0x0022405c IOCTL call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-06T15:00:00.000Z
CVE-2014-9643 
K7Sentry.sys in K7 Computing Ultimate Security, Anti-Virus Plus, and Total Security before 14.2.0.253 allows local users to write to arbitrary memory locations, and consequently gain privileges, via a crafted 0x95002570, 0x95002574, 0x95002580, 0x950025a8, 0x950025ac, or 0x950025c8 IOCTL call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-06T15:00:00.000Z
CVE-2014-9644 
The Crypto API in the Linux kernel before 3.18.5 allows local users to load arbitrary kernel modules via a bind system call for an AF_ALG socket with a parenthesized module template expression in the salg_name field, as demonstrated by the vfat(aes) expression, a different vulnerability than CVE-2013-7421.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-02T11:00:00.000Z
CVE-2014-9645 
The add_probe function in modutils/modprobe.c in BusyBox before 1.23.0 allows local users to bypass intended restrictions on loading kernel modules via a / (slash) character in a module name, as demonstrated by an "ifconfig /usbserial up" command or a "mount -t /snd_pcm none /" command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-12T06:05:00.000Z
CVE-2014-9646 
Unquoted Windows search path vulnerability in the GoogleChromeDistribution::DoPostUninstallOperations function in installer/util/google_chrome_distribution.cc in the uninstall-survey feature in Google Chrome before 40.0.2214.91 allows local users to gain privileges via a Trojan horse program in the %SYSTEMDRIVE% directory, as demonstrated by program.exe, a different vulnerability than CVE-2015-1205.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-27T11:00:00.000Z
CVE-2014-9647 
Use-after-free vulnerability in PDFium, as used in Google Chrome before 40.0.2214.91, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document, related to fpdfsdk/src/fpdfview.cpp and fpdfsdk/src/fsdk_mgr.cpp, a different vulnerability than CVE-2015-1205.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-27T11:00:00.000Z
CVE-2014-9648 
components/navigation_interception/intercept_navigation_resource_throttle.cc in Google Chrome before 40.0.2214.91 on Android does not properly restrict use of intent: URLs to open an application after navigation to a web site, which allows remote attackers to cause a denial of service (loss of browser access to that site) via crafted JavaScript code, as demonstrated by pandora.com and the Pandora application, a different vulnerability than CVE-2015-1205.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-27T11:00:00.000Z
CVE-2014-9649 
Cross-site scripting (XSS) vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary web script or HTML via the path info to api/, which is not properly handled in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-27T17:00:00.000Z
CVE-2014-9650 
CRLF injection vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the download parameter to api/definitions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-27T17:00:00.000Z
CVE-2014-9651 
Buffer overflow in CHICKEN 4.9.0.x before 4.9.0.2, 4.9.x before 4.9.1, and before 5.0 allows attackers to have unspecified impact via a positive START argument to the "substring-index[-ci] procedures."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-28T20:57:00.000Z
CVE-2014-9652 
The mconvert function in softmagic.c in file before 5.21, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not properly handle a certain string-length field during a copy of a truncated version of a Pascal string, which might allow remote attackers to cause a denial of service (out-of-bounds memory access and application crash) via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-30T10:00:00.000Z
CVE-2014-9653 
readelf.c in file before 5.22, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not consider that pread calls sometimes read only a subset of the available data, which allows remote attackers to cause a denial of service (uninitialized memory access) or possibly have unspecified other impact via a crafted ELF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-30T10:00:00.000Z
CVE-2014-9654 
The Regular Expressions package in International Components for Unicode (ICU) for C/C++ before 2014-12-03, as used in Google Chrome before 40.0.2214.91, calculates certain values without ensuring that they can be represented in a 24-bit field, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted string, a related issue to CVE-2014-7923.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-24T06:12:00.000Z
CVE-2014-9655 
The (1) putcontig8bitYCbCr21tile function in tif_getimage.c or (2) NeXTDecode function in tif_next.c in LibTIFF allows remote attackers to cause a denial of service (uninitialized memory access) via a crafted TIFF image, as demonstrated by libtiff-cvs-1.tif and libtiff-cvs-2.tif.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-13T17:00:00.000Z
CVE-2014-9656 
The tt_sbit_decoder_load_image function in sfnt/ttsbit.c in FreeType before 2.5.4 does not properly check for an integer overflow, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted OpenType font.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-08T11:00:00.000Z
CVE-2014-9657 
The tt_face_load_hdmx function in truetype/ttpload.c in FreeType before 2.5.4 does not establish a minimum record size, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted TrueType font.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-08T11:00:00.000Z
CVE-2014-9658 
The tt_face_load_kern function in sfnt/ttkern.c in FreeType before 2.5.4 enforces an incorrect minimum table length, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted TrueType font.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-08T11:00:00.000Z
CVE-2014-9659 
cff/cf2intrp.c in the CFF CharString interpreter in FreeType before 2.5.4 proceeds with additional hints after the hint mask has been computed, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted OpenType font.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2240.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-08T11:00:00.000Z
CVE-2014-9660 
The _bdf_parse_glyphs function in bdf/bdflib.c in FreeType before 2.5.4 does not properly handle a missing ENDCHAR record, which allows remote attackers to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a crafted BDF font.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-08T11:00:00.000Z
CVE-2014-9661 
type42/t42parse.c in FreeType before 2.5.4 does not consider that scanning can be incomplete without triggering an error, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted Type42 font.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-08T11:00:00.000Z
CVE-2014-9662 
cff/cf2ft.c in FreeType before 2.5.4 does not validate the return values of point-allocation functions, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted OTF font.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-08T11:00:00.000Z
CVE-2014-9663 
The tt_cmap4_validate function in sfnt/ttcmap.c in FreeType before 2.5.4 validates a certain length field before that field's value is completely calculated, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted cmap SFNT table.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-08T11:00:00.000Z
CVE-2014-9664 
FreeType before 2.5.4 does not check for the end of the data during certain parsing actions, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted Type42 font, related to type42/t42parse.c and type1/t1load.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-08T11:00:00.000Z
CVE-2014-9665 
The Load_SBit_Png function in sfnt/pngshim.c in FreeType before 2.5.4 does not restrict the rows and pitch values of PNG data, which allows remote attackers to cause a denial of service (integer overflow and heap-based buffer overflow) or possibly have unspecified other impact by embedding a PNG file in a .ttf font file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-08T11:00:00.000Z
CVE-2014-9666 
The tt_sbit_decoder_init function in sfnt/ttsbit.c in FreeType before 2.5.4 proceeds with a count-to-size association without restricting the count value, which allows remote attackers to cause a denial of service (integer overflow and out-of-bounds read) or possibly have unspecified other impact via a crafted embedded bitmap.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-08T11:00:00.000Z
CVE-2014-9667 
sfnt/ttload.c in FreeType before 2.5.4 proceeds with offset+length calculations without restricting the values, which allows remote attackers to cause a denial of service (integer overflow and out-of-bounds read) or possibly have unspecified other impact via a crafted SFNT table.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-08T11:00:00.000Z
CVE-2014-9668 
The woff_open_font function in sfnt/sfobjs.c in FreeType before 2.5.4 proceeds with offset+length calculations without restricting length values, which allows remote attackers to cause a denial of service (integer overflow and heap-based buffer overflow) or possibly have unspecified other impact via a crafted Web Open Font Format (WOFF) file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-08T11:00:00.000Z
CVE-2014-9669 
Multiple integer overflows in sfnt/ttcmap.c in FreeType before 2.5.4 allow remote attackers to cause a denial of service (out-of-bounds read or memory corruption) or possibly have unspecified other impact via a crafted cmap SFNT table.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-08T11:00:00.000Z
CVE-2014-9670 
Multiple integer signedness errors in the pcf_get_encodings function in pcf/pcfread.c in FreeType before 2.5.4 allow remote attackers to cause a denial of service (integer overflow, NULL pointer dereference, and application crash) via a crafted PCF file that specifies negative values for the first column and first row.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-08T11:00:00.000Z
CVE-2014-9671 
Off-by-one error in the pcf_get_properties function in pcf/pcfread.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PCF file with a 0xffffffff size value that is improperly incremented.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-08T11:00:00.000Z
CVE-2014-9672 
Array index error in the parse_fond function in base/ftmac.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information from process memory via a crafted FOND resource in a Mac font file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-08T11:00:00.000Z
CVE-2014-9673 
Integer signedness error in the Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted Mac font.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-08T11:00:00.000Z
CVE-2014-9674 
The Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.5.4 proceeds with adding to length values without validating the original values, which allows remote attackers to cause a denial of service (integer overflow and heap-based buffer overflow) or possibly have unspecified other impact via a crafted Mac font.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-08T11:00:00.000Z
CVE-2014-9675 
bdf/bdflib.c in FreeType before 2.5.4 identifies property names by only verifying that an initial substring is present, which allows remote attackers to discover heap pointer values and bypass the ASLR protection mechanism via a crafted BDF font.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-08T11:00:00.000Z
CVE-2014-9676 
The seg_write_packet function in libavformat/segment.c in ffmpeg 2.1.4 and earlier does not free the correct memory location, which allows remote attackers to cause a denial of service ("invalid memory handler") and possibly execute arbitrary code via a crafted video that triggers a use after free.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-28T01:00:00.000Z
CVE-2014-9677 
Cross-site scripting (XSS) vulnerability in FlexPaperViewer.swf in Flexpaper before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via the Swfile parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-17T14:00:00.000Z
CVE-2014-9678 
FlexPaperViewer.swf in Flexpaper before 2.3.1 allows remote attackers to conduct content-spoofing attacks via the Swfile parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-17T14:00:00.000Z
CVE-2014-9679 
Integer underflow in the cupsRasterReadPixels function in filter/raster.c in CUPS before 2.0.2 allows remote attackers to have unspecified impact via a malformed compressed raster file, which triggers a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-19T15:00:00.000Z
CVE-2014-9680 
sudo before 1.8.12 does not ensure that the TZ environment variable is associated with a zoneinfo file, which allows local users to open arbitrary files for read access (but not view file contents) by running a program within an sudo session, as demonstrated by interfering with terminal output, discarding kernel-log messages, or repositioning tape drives.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-24T06:12:00.000Z
CVE-2014-9682 
The dns-sync module before 0.1.1 for node.js allows context-dependent attackers to execute arbitrary commands via shell metacharacters in the first argument to the resolve API function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-28T01:00:00.000Z
CVE-2014-9683 
Off-by-one error in the ecryptfs_decode_from_filename function in fs/ecryptfs/crypto.c in the eCryptfs subsystem in the Linux kernel before 3.18.2 allows local users to cause a denial of service (buffer overflow and system crash) or possibly gain privileges via a crafted filename.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-03T11:00:00.000Z
CVE-2014-9684 
OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service (disk consumption) by creating a large number of images using the task v2 API and then deleting them before the uploads finish, a different vulnerability than CVE-2015-1881.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-24T15:00:00.000Z
CVE-2014-9685 
Multiple cross-site scripting (XSS) vulnerabilities in Vanilla Forums before 2.0.18.13 and 2.1.x before 2.1.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-25T22:00:00.000Z