rainbutterfly/cve_corpus huggingface dataset:
CVE-2014-5015 
bozotic HTTP server (aka bozohttpd) before 20140708, as used in NetBSD, truncates paths when checking .htpasswd restrictions, which allows remote attackers to bypass the HTTP authentication scheme and access restrictions via a long path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-24T14:00:00.000Z
CVE-2014-5016 
Multiple cross-site scripting (XSS) vulnerabilities in LimeSurvey 2.05+ Build 140618 allow remote attackers to inject arbitrary web script or HTML via (1) the pid attribute to the getAttribute_json function to application/controllers/admin/participantsaction.php in CPDB, (2) the sa parameter to application/views/admin/globalSettings_view.php, or (3) a crafted CSV file to the "Import CSV" functionality.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-21T14:00:00.000Z
CVE-2014-5017 
SQL injection vulnerability in CPDB in application/controllers/admin/participantsaction.php in LimeSurvey 2.05+ Build 140618 allows remote attackers to execute arbitrary SQL commands via the sidx parameter in a JSON request to admin/participants/sa/getParticipants_json, related to a search parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-21T14:00:00.000Z
CVE-2014-5018 
Incomplete blacklist vulnerability in the autoEscape function in common_helper.php in LimeSurvey 2.05+ Build 140618 allows remote attackers to conduct cross-site scripting (XSS) attacks via the GBK charset in the loadname parameter to index.php, related to the survey resume.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-21T14:00:00.000Z
CVE-2014-5019 
The multisite feature in Drupal 6.x before 6.32 and 7.x before 7.29 allows remote attackers to cause a denial of service via a crafted HTTP Host header, related to determining which configuration file to use.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-22T14:00:00.000Z
CVE-2014-5020 
The File module in Drupal 7.x before 7.29 does not properly check permissions to view files, which allows remote authenticated users with certain permissions to bypass intended restrictions and read files by attaching the file to content with a file field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-22T14:00:00.000Z
CVE-2014-5021 
Cross-site scripting (XSS) vulnerability in the Form API in Drupal 6.x before 6.32 and possibly 7.x before 7.29 allows remote authenticated users with the "administer taxonomy" permission to inject arbitrary web script or HTML via an option group label.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-22T14:00:00.000Z
CVE-2014-5022 
Cross-site scripting (XSS) vulnerability in the Ajax system in Drupal 7.x before 7.29 allows remote attackers to inject arbitrary web script or HTML via vectors involving forms with an Ajax-enabled textfield and a file field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-22T14:00:00.000Z
CVE-2014-5023 
Repository.php in Gitter, as used in Gitlist, allows remote attackers with commit privileges to execute arbitrary commands via shell metacharacters in a branch name, as demonstrated by a "git checkout -b" command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-22T14:00:00.000Z
CVE-2014-5024 
Cross-site scripting (XSS) vulnerability in sgms/panelManager in Dell SonicWALL GMS, Analyzer, and UMA before 7.2 SP1 allows remote attackers to inject arbitrary web script or HTML via the node_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-24T14:00:00.000Z
CVE-2014-5025 
Cross-site scripting (XSS) vulnerability in data_sources.php in Cacti 0.8.8b allows remote authenticated users with console access to inject arbitrary web script or HTML via the name_cache parameter in a ds_edit action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-20T17:00:00.000Z
CVE-2014-5026 
Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.8b allow remote authenticated users with console access to inject arbitrary web script or HTML via a (1) Graph Tree Title in a delete or (2) edit action; (3) CDEF Name, (4) Data Input Method Name, or (5) Host Templates Name in a delete action; (6) Data Source Title; (7) Graph Title; or (8) Graph Template Name in a delete or (9) duplicate action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-20T17:00:00.000Z
CVE-2014-5027 
Cross-site scripting (XSS) vulnerability in Review Board 1.7.x before 1.7.27 and 2.0.x before 2.0.4 allows remote attackers to inject arbitrary web script or HTML via a query parameter to a diff fragment page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-25T19:00:00.000Z
CVE-2014-5028 
The Original File and Patched File resources in Review Board 1.7.x before 1.7.27 and 2.0.x before 2.0.4 allow remote authenticated users to bypass intended access restrictions and obtain sensitive information from repository files by leveraging knowledge of database ids.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-29T18:00:00.000Z
CVE-2014-5029 
The web interface in CUPS 1.7.4 allows local users in the lp group to read arbitrary files via a symlink attack on a file in /var/cache/cups/rss/ and language[0] set to null.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3537.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-29T14:00:00.000Z
CVE-2014-5030 
CUPS before 2.0 allows local users to read arbitrary files via a symlink attack on (1) index.html, (2) index.class, (3) index.pl, (4) index.php, (5) index.pyc, or (6) index.py.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-29T14:00:00.000Z
CVE-2014-5031 
The web interface in CUPS before 2.0 does not check that files have world-readable permissions, which allows remote attackers to obtains sensitive information via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-29T14:00:00.000Z
CVE-2014-5032 
GLPI before 0.84.7 does not properly restrict access to cost information, which allows remote attackers to obtain sensitive information via the cost criteria in the search bar.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-14T18:00:00.000Z
CVE-2014-5033 
KDE kdelibs before 4.14 and kauth before 5.1 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, related to CVE-2013-4288 and "PID reuse race conditions."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-19T18:00:00.000Z
CVE-2014-5034 
Cross-site request forgery (CSRF) vulnerability in the Brute Force Login Protection module 1.3 for WordPress allows remote attackers to hijack the authentication of unspecified users for requests that have unknown impact via a crafted request to the brute-force-login-protection page to wp-admin/options-general.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-06T16:00:00.000Z
CVE-2014-5035 
The Netconf (TCP) service in OpenDaylight 1.0 allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference in an XML-RPC message, related to an XML External Entity (XXE) issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-26T14:00:00.000Z
CVE-2014-5036 
The Storage Controller (SC) component in Eucalyptus 3.4.2 through 4.0.x before 4.0.1, when Dell Equallogic SAN is used, logs the CHAP user credentials, which allows local users to obtain sensitive information by reading the logs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-05T14:00:00.000Z
CVE-2014-5037 
Eucalyptus 4.0.0 through 4.0.1, when the log level is set to INFO, logs user and system passwords, which allows local users to obtain sensitive information by reading cloud-requests.log.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-07T19:00:00.000Z
CVE-2014-5038 
Eucalyptus 3.0.0 through 4.0.1, when the log level is set to DEBUG or lower, logs user and system passwords, which allows local users to obtain sensitive information by reading the cloud log files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-07T19:00:00.000Z
CVE-2014-5039 
Cross-site scripting (XSS) vulnerability in Eucalyptus Management Console (EMC) 4.0.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-31T21:52:58.000Z
CVE-2014-5040 
HP Helion Eucalyptus 4.1.x before 4.1.2 and HPE Helion Eucalyptus 4.2.x before 4.2.1 allow remote authenticated users to bypass intended access restrictions and modify arbitrary (1) access key credentials by leveraging knowledge of a key ID or (2) signing certificates by leveraging knowledge of a certificate ID.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-01-05T02:00:00.000Z
CVE-2014-5044 
Multiple integer overflows in libgfortran might allow remote attackers to execute arbitrary code or cause a denial of service (Fortran application crash) via vectors related to array allocation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-07T15:00:00.000Z
CVE-2014-5045 
The mountpoint_last function in fs/namei.c in the Linux kernel before 3.15.8 does not properly maintain a certain reference count during attempts to use the umount system call in conjunction with a symlink, which allows local users to cause a denial of service (memory consumption or use-after-free) or possibly have unspecified other impact via the umount program.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-01T10:00:00.000Z
CVE-2014-5068 
Directory traversal vulnerability in the web application in Symmetricom s350i 2.70.15 allows remote attackers to read arbitrary files via a (1) ../ (dot dot slash) or (2) ..\ (dot dot forward slash) before a file name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-11T16:00:00.000Z
CVE-2014-5069 
Cross-site scripting (XSS) vulnerability in Symmetricom s350i 2.70.15 allows remote attackers to inject arbitrary web script or HTML via vectors involving system logs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-08T19:00:00.000Z
CVE-2014-5070 
Symmetricom s350i 2.70.15 allows remote authenticated users to gain privileges via vectors related to pushing unauthenticated users to the login page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-11T16:00:00.000Z
CVE-2014-5071 
SQL injection vulnerability in the checkPassword function in Symmetricom s350i 2.70.15 allows remote attackers to execute arbitrary SQL commands via vectors involving a username.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-08T19:00:00.000Z
CVE-2014-5072 
Cross-site request forgery (CSRF) vulnerability in WP Security Audit Log plugin before 1.2.5 for WordPress allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-06T16:00:00.000Z
CVE-2014-5073 
vmtadmin.cgi in VMTurbo Operations Manager before 4.6 build 28657 allows remote attackers to execute arbitrary commands via shell metacharacters in the fileDate parameter in a DOWN call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-29T17:00:00.000Z
CVE-2014-5074 
Siemens SIMATIC S7-1500 CPU devices with firmware before 1.6 allow remote attackers to cause a denial of service (device restart and STOP transition) via crafted TCP packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-17T23:00:00.000Z
CVE-2014-5075 
The Ignite Realtime Smack XMPP API 4.x before 4.0.2, and 3.x and 2.x when a custom SSLContext is used, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-25T21:00:00.000Z
CVE-2014-5076 
The La Banque Postale application before 3.2.6 for Android does not prevent the launching of an activity by a component of another application, which allows attackers to obtain sensitive cached banking information via crafted intents, as demonstrated by the drozer framework.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-02T10:00:00.000Z
CVE-2014-5077 
The sctp_assoc_update function in net/sctp/associola.c in the Linux kernel through 3.15.8, when SCTP authentication is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and OOPS) by starting to establish an association between two endpoints immediately after an exchange of INIT and INIT ACK chunks to establish an earlier association between these endpoints in the opposite direction.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-01T10:00:00.000Z
CVE-2014-5081 
sphider prior to 1.3.6, sphider-pro prior to 3.2, and sphider-plus prior to 3.2 allow authentication bypass
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-10T12:29:49.000Z
CVE-2014-5082 
Multiple SQL injection vulnerabilities in admin/admin.php in Sphider 1.3.6 and earlier, Sphider Pro, and Sphider-plus allow remote attackers to execute arbitrary SQL commands via the (1) site_id or (2) url parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-06T18:00:00.000Z
CVE-2014-5083 
A Command Execution vulnerability exists in Sphider before 1.3.6 due to insufficient sanitization of fwrite to conf.php, which could let a remote malicious user execute arbitrary code. CVE-2014-5083 pertains to instances of fwrite in Sphider.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-10T14:51:15.000Z
CVE-2014-5084 
A Command Execution vulnerability exists in Sphider Pro 3.2 due to insufficient sanitization of fwrite, which could let a remote malicious user execute arbitrary code. CVE-2014-5084 pertains to instances of fwrite in Sphider Pro only, but do not exist in either Sphider or Sphider Plus.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-10T14:20:52.000Z
CVE-2014-5085 
A Command Execution vulnerability exists in Sphider Plus 3.2 due to insufficient sanitization of fwrite to conf.php, which could let a remote malicious user execute arbitrary code. CVE-2014-5085 pertains to instances of fwrite in Sphider Plus, but do not exist in either Sphider or Sphider Pro.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-10T14:16:05.000Z
CVE-2014-5086 
A Command Execution vulnerability exists in Sphider Pro, and Sphider Plus 3.2 due to insufficient sanitization of fwrite to conf.php, which could let a remote malicious user execute arbitrary code. CVE-2014-5086 pertains to instances of fwrite in Sphider Pro and Sphider Plus only, but don’t exist in Sphider.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-10T14:06:02.000Z
CVE-2014-5087 
A vulnerability exists in Sphider Search Engine prior to 1.3.6 due to exec calls in admin/spiderfuncs.php, which could let a remote malicious user execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-07T17:36:48.000Z
CVE-2014-5088 
Cross-site scripting (XSS) vulnerability in Status2k allows remote attackers to inject arbitrary web script or HTML via the username to login.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-06T18:00:00.000Z
CVE-2014-5089 
SQL injection vulnerability in admin/options/logs.php in Status2k allows remote authenticated administrators to execute arbitrary SQL commands via the log parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-06T18:00:00.000Z
CVE-2014-5090 
admin/options/logs.php in Status2k allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the Location field in Add Logs in the Admin Panel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-06T18:00:00.000Z
CVE-2014-5091 
A vulnerability exits in Status2K 2.5 Server Monitoring Software via the multies parameter to includes/functions.php, which could let a malicious user execute arbitrary PHP code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-07T17:17:33.000Z
CVE-2014-5092 
Status2k allows Remote Command Execution in admin/options/editpl.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-10T13:28:59.000Z
CVE-2014-5093 
Status2k does not remove the install directory allowing credential reset.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-10T13:34:04.000Z
CVE-2014-5094 
Status2k allows remote attackers to obtain configuration information via a phpinfo action in a request to status/index.php, which calls the phpinfo function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-20T15:00:00.000Z
CVE-2014-5097 
Multiple SQL injection vulnerabilities in Free Reprintables ArticleFR 3.0.4 and earlier allow remote attackers to execute arbitrary SQL commands via the id parameter in a (1) get or (2) set action to rate.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-22T14:00:00.000Z
CVE-2014-5098 
Cross-site scripting (XSS) vulnerability in the Search module before 1.2.2 in Jamroom allows remote attackers to inject arbitrary web script or HTML via the query string to search/results/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-20T15:00:00.000Z
CVE-2014-5100 
Multiple cross-site request forgery (CSRF) vulnerabilities in Omeka before 2.2.1 allow remote attackers to hijack the authentication of administrators for requests that (1) add a new super user account via a request to admin/users/add, (2) insert cross-site scripting (XSS) sequences via the api_key_label parameter to admin/users/api-keys/1, or (3) disable file validation via a request to admin/settings/edit-security.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-25T19:00:00.000Z
CVE-2014-5101 
Multiple cross-site scripting (XSS) vulnerabilities in WeBid 1.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) TPL_name, (2) TPL_nick, (3) TPL_email, (4) TPL_year, (5) TPL_address, (6) TPL_city, (7) TPL_prov, (8) TPL_zip, (9) TPL_phone, (10) TPL_pp_email, (11) TPL_authnet_id, (12) TPL_authnet_pass, (13) TPL_worldpay_id, (14) TPL_toocheckout_id, or (15) TPL_moneybookers_email in a first action to register.php or the (16) username parameter in a login action to user_login.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-25T19:00:00.000Z
CVE-2014-5102 
SQL injection vulnerability in vBulletin 5.0.4 through 5.1.3 Alpha 5 allows remote attackers to execute arbitrary SQL commands via the criteria[startswith] parameter to ajax/render/memberlist_items.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-25T19:00:00.000Z
CVE-2014-5103 
Cross-site scripting (XSS) vulnerability in ZOHO ManageEngine EventLog Analyzer 9 build 9000 allows remote attackers to inject arbitrary web script or HTML via the j_username parameter to event/j_security_check. Fixed in Version 10 Build 10000.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-25T19:00:00.000Z
CVE-2014-5104 
Multiple SQL injection vulnerabilities in ol-commerce 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) a_country parameter in a process action to affiliate_signup.php, (2) affiliate_banner_id parameter to affiliate_show_banner.php, (3) country parameter in a process action to create_account.php, or (4) entry_country_id parameter in an edit action to admin/create_account.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-28T15:00:00.000Z
CVE-2014-5105 
Multiple cross-site scripting (XSS) vulnerabilities in ol-commerce 2.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) a_country parameter in a process action to affiliate_signup.php or (2) entry_country_id parameter in an edit action to admin/create_account.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-28T15:00:00.000Z
CVE-2014-5106 
Cross-site scripting (XSS) vulnerability in Invision Power IP.Board (aka IPB or Power Board) 3.4.x through 3.4.6 allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header to admin/install/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-28T15:00:00.000Z
CVE-2014-5107 
concrete5 before 5.6.3 allows remote attackers to obtain the installation path via a direct request to (1) system/basics/editor.php, (2) system/view.php, (3) system/environment/file_storage_locations.php, (4) system/mail/importers.php, (5) system/mail/method.php, (6) system/permissions/file_types.php, (7) system/permissions/files.php, (8) system/permissions/tasks.php, (9) system/permissions/users.php, (10) system/seo/view.php, (11) view.php, (12) users/attributes.php, (13) scrapbook/view.php, (14) pages/attributes.php, (15) files/attributes.php, or (16) files/search.php in single_pages/dashboard/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-28T15:00:00.000Z
CVE-2014-5108 
Cross-site scripting (XSS) vulnerability in single_pages\download_file.php in concrete5 before 5.6.3 allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header to index.php/download_file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-28T15:00:00.000Z
CVE-2014-5109 
SQL injection vulnerability in maint/modules/endpointcfg/endpoint_generic.php in Fonality trixbox allows remote attackers to execute arbitrary SQL commands via the mac parameter in a Submit action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-28T15:00:00.000Z
CVE-2014-5110 
Cross-site scripting (XSS) vulnerability in user/help/html/index.php in Fonality trixbox allows remote attackers to inject arbitrary web script or HTML via the id_nodo parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-28T15:00:00.000Z