rainbutterfly/cve_corpus huggingface dataset:
CVE-2014-3181 
Multiple stack-based buffer overflows in the magicmouse_raw_event function in drivers/hid/hid-magicmouse.c in the Magic Mouse HID driver in the Linux kernel through 3.16.3 allow physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted device that provides a large amount of (1) EHCI or (2) XHCI data associated with an event.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-28T10:00:00.000Z
CVE-2014-3182 
Array index error in the logi_dj_raw_event function in drivers/hid/hid-logitech-dj.c in the Linux kernel before 3.16.2 allows physically proximate attackers to execute arbitrary code or cause a denial of service (invalid kfree) via a crafted device that provides a malformed REPORT_TYPE_NOTIF_DEVICE_UNPAIRED value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-28T10:00:00.000Z
CVE-2014-3183 
Heap-based buffer overflow in the logi_dj_ll_raw_request function in drivers/hid/hid-logitech-dj.c in the Linux kernel before 3.16.2 allows physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted device that specifies a large report size for an LED report.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-28T10:00:00.000Z
CVE-2014-3184 
The report_fixup functions in the HID subsystem in the Linux kernel before 3.16.2 might allow physically proximate attackers to cause a denial of service (out-of-bounds write) via a crafted device that provides a small report descriptor, related to (1) drivers/hid/hid-cherry.c, (2) drivers/hid/hid-kye.c, (3) drivers/hid/hid-lg.c, (4) drivers/hid/hid-monterey.c, (5) drivers/hid/hid-petalynx.c, and (6) drivers/hid/hid-sunplus.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-28T10:00:00.000Z
CVE-2014-3185 
Multiple buffer overflows in the command_port_read_callback function in drivers/usb/serial/whiteheat.c in the Whiteheat USB Serial Driver in the Linux kernel before 3.16.2 allow physically proximate attackers to execute arbitrary code or cause a denial of service (memory corruption and system crash) via a crafted device that provides a large amount of (1) EHCI or (2) XHCI data associated with a bulk response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-28T10:00:00.000Z
CVE-2014-3186 
Buffer overflow in the picolcd_raw_event function in devices/hid/hid-picolcd_core.c in the PicoLCD HID device driver in the Linux kernel through 3.16.3, as used in Android on Nexus 7 devices, allows physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted device that sends a large report.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-28T10:00:00.000Z
CVE-2014-3187 
Google Chrome before 37.0.2062.60 and 38.x before 38.0.2125.59 on iOS does not properly restrict processing of (1) facetime:// and (2) facetime-audio:// URLs, which allows remote attackers to obtain video and audio data from a device via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-08T10:00:00.000Z
CVE-2014-3188 
Google Chrome before 38.0.2125.101 and Chrome OS before 38.0.2125.101 do not properly handle the interaction of IPC and Google V8, which allows remote attackers to execute arbitrary code via vectors involving JSON data, related to improper parsing of an escaped index by ParseJsonObject in json-parser.h.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-08T10:00:00.000Z
CVE-2014-3189 
The chrome_pdf::CopyImage function in pdf/draw_utils.cc in the PDFium component in Google Chrome before 38.0.2125.101 does not properly validate image-data dimensions, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-08T10:00:00.000Z
CVE-2014-3190 
Use-after-free vulnerability in the Event::currentTarget function in core/events/Event.cpp in Blink, as used in Google Chrome before 38.0.2125.101, allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted JavaScript code that accesses the path property of an Event object.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-08T10:00:00.000Z
CVE-2014-3191 
Use-after-free vulnerability in Blink, as used in Google Chrome before 38.0.2125.101, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that triggers a widget-position update that improperly interacts with the render tree, related to the FrameView::updateLayoutAndStyleForPainting function in core/frame/FrameView.cpp and the RenderLayerScrollableArea::setScrollOffset function in core/rendering/RenderLayerScrollableArea.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-08T10:00:00.000Z
CVE-2014-3192 
Use-after-free vulnerability in the ProcessingInstruction::setXSLStyleSheet function in core/dom/ProcessingInstruction.cpp in the DOM implementation in Blink, as used in Google Chrome before 38.0.2125.101, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-08T10:00:00.000Z
CVE-2014-3193 
The SessionService::GetLastSession function in browser/sessions/session_service.cc in Google Chrome before 38.0.2125.101 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via vectors that leverage "type confusion" for callback processing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-08T10:00:00.000Z
CVE-2014-3194 
Use-after-free vulnerability in the Web Workers implementation in Google Chrome before 38.0.2125.101 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-08T10:00:00.000Z
CVE-2014-3195 
Google V8, as used in Google Chrome before 38.0.2125.101, does not properly track JavaScript heap-memory allocations as allocations of uninitialized memory and does not properly concatenate arrays of double-precision floating-point numbers, which allows remote attackers to obtain sensitive information via crafted JavaScript code, related to the PagedSpace::AllocateRaw and NewSpace::AllocateRaw functions in heap/spaces-inl.h, the LargeObjectSpace::AllocateRaw function in heap/spaces.cc, and the Runtime_ArrayConcat function in runtime.cc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-08T10:00:00.000Z
CVE-2014-3196 
base/memory/shared_memory_win.cc in Google Chrome before 38.0.2125.101 on Windows does not properly implement read-only restrictions on shared memory, which allows attackers to bypass a sandbox protection mechanism via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-08T10:00:00.000Z
CVE-2014-3197 
The NavigationScheduler::schedulePageBlock function in core/loader/NavigationScheduler.cpp in Blink, as used in Google Chrome before 38.0.2125.101, does not properly provide substitute data for pages blocked by the XSS auditor, which allows remote attackers to obtain sensitive information via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-08T10:00:00.000Z
CVE-2014-3198 
The Instance::HandleInputEvent function in pdf/instance.cc in the PDFium component in Google Chrome before 38.0.2125.101 interprets a certain -1 value as an index instead of a no-visible-page error code, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-08T10:00:00.000Z
CVE-2014-3199 
The wrap function in bindings/core/v8/custom/V8EventCustom.cpp in the V8 bindings in Blink, as used in Google Chrome before 38.0.2125.101, has an erroneous fallback outcome for wrapper-selection failures, which allows remote attackers to cause a denial of service via vectors that trigger stopping a worker process that had been handling an Event object.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-08T10:00:00.000Z
CVE-2014-3200 
Multiple unspecified vulnerabilities in Google Chrome before 38.0.2125.101 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-08T10:00:00.000Z
CVE-2014-3201 
core/rendering/compositing/RenderLayerCompositor.cpp in Blink, as used in Google Chrome before 38.0.2125.102 on Android, does not properly handle a certain IFRAME overflow condition, which allows remote attackers to spoof content via a crafted web site that interferes with the scrollbar.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-10T01:00:00.000Z
CVE-2014-3202 
Unity before 7.2.1 does not properly handle entry activation, which allows physically proximate attackers to bypass the lock screen by holding the ENTER key, which triggers the process to crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-06T14:00:00.000Z
CVE-2014-3203 
Unity before 7.2.1, as used in Ubuntu 14.04, does not properly restrict access to the Dash when the lock screen is active, which allows physically proximate attackers to bypass the lock screen and execute arbitrary commands, as demonstrated by pressing the SUPER key before the screen auto-locks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-06T14:00:00.000Z
CVE-2014-3204 
Unity before 7.2.1, as used in Ubuntu 14.04, does not properly handle keyboard shortcuts, which allows physically proximate attackers to bypass the lock screen and execute arbitrary commands, as demonstrated by right-clicking on the indicator bar and then pressing the ALT and F2 keys.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-06T14:00:00.000Z
CVE-2014-3205 
backupmgt/pre_connect_check.php in Seagate BlackArmor NAS contains a hard-coded password of '!~@##$$%FREDESWWSED' for a backdoor user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-23T17:00:00.000Z
CVE-2014-3206 
Seagate BlackArmor NAS allows remote attackers to execute arbitrary code via the session parameter to localhost/backupmgt/localJob.php or the auth_name parameter to localhost/backupmgmt/pre_connect_check.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-23T17:00:00.000Z
CVE-2014-3207 
Cross-site scripting (XSS) vulnerability in wserver.ml in SKS Keyserver before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to pks/lookup/undefined1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-08T14:00:00.000Z
CVE-2014-3208 
A Denial of Service vulnerability exists in askpop3d 0.7.7 in free (pszQuery),
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-13T19:25:29.000Z
CVE-2014-3209 
The ldns-keygen tool in ldns 1.6.x uses the current umask to set the privileges of the private key, which might allow local users to obtain the private key by reading the file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-16T01:00:00.000Z
CVE-2014-3210 
SQL injection vulnerability in dopbs-backend-forms.php in the Booking System (Booking Calendar) plugin before 1.3 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the booking_form_id parameter to wp-admin/admin-ajax.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-22T15:00:00.000Z
CVE-2014-3211 
Publify before 8.0.1 is vulnerable to a Denial of Service attack
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-09T13:13:05.000Z
CVE-2014-3214 
The prefetch implementation in named in ISC BIND 9.10.0, when a recursive nameserver is enabled, allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via a DNS query that triggers a response with unspecified attributes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-09T01:00:00.000Z
CVE-2014-3215 
seunshare in policycoreutils 2.2.5 is owned by root with 4755 permissions, and executes programs in a way that changes the relationship between the setuid system call and the getresuid saved set-user-ID value, which makes it easier for local users to gain privileges by leveraging a program that mistakenly expected that it could permanently drop privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-08T10:00:00.000Z
CVE-2014-3216 
GOM Media Player 2.2.57.5189 and earlier allows remote attackers to cause a denial of service (crash) via a crafted .ogg file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-10T14:00:00.000Z
CVE-2014-3219 
fish before 2.1.1 allows local users to write to arbitrary files via a symlink attack on (1) /tmp/fishd.log.%s, (2) /tmp/.pac-cache.$USER, (3) /tmp/.yum-cache.$USER, or (4) /tmp/.rpm-cache.$USER.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-09T22:00:00.000Z
CVE-2014-3220 
F5 BIG-IQ Cloud and Security 4.0.0 through 4.1.0 allows remote authenticated users to change the password of arbitrary users via the name parameter in a request to the user's page in mgmt/shared/authz/users/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-05T17:00:00.000Z
CVE-2014-3221 
Huawei Eudemon8000E firewall with software V200R001C01SPC800 and earlier versions allows users to log in to the device using Telnet or SSH. When an attacker sends to the device a mass of TCP packets with special structure, the logging process becomes slow and users may be unable to log in to the device.
Problem types: description: DoS
Affected products: vendor: n/a
product: Eudemon8000E V200R001C01SPC800 and earlier versions
Published: 2017-04-02T20:00:00.000Z
CVE-2014-3222 
In Huawei eSpace Meeting with software V100R001C03SPC201 and the earlier versions, attackers that obtain the permissions assigned to common users can elevate privileges to access and set specific key resources.
Problem types: description: Improper User Permission Setting
Affected products: vendor: n/a
product: eSpace Meeting V100R001C03SPC201 and the earlier versions
Published: 2017-04-02T20:00:00.000Z
CVE-2014-3223 
Huawei S9300 with software before V100R006SPH013 and S2300,S3300,S5300,S6300 with software before V100R006SPH010 support Y.1731 and therefore have the Y.1731 vulnerability in processing special packets. The vulnerability causes the restart of switches.
Problem types: description: Y.1731
Affected products: vendor: n/a
product: S9300,S2300,S3300,S5300,S6300 S9300 with software V100R006C00SPC500??S9300 with software V100R006C00SPC800,S2300,S3300,S5300,S6300 with software V100R006C00SPC800,V100R006C01SPC100, V100R006C03
Published: 2017-04-02T20:00:00.000Z
CVE-2014-3224 
Huawei Quidway S9700 V200R003C00SPC500, Quidway S9300 V200R003C00SPC500, Quidway S7700 V200R003C00SPC500, Quidway S6700 V200R003C00SPC300, Quidway S6300 V200R003C00SPC300, Quidway S5700 V200R003C00SPC300, Quidway S5300 V200R003C00SPC300 enable attackers to launch DoS attacks by crafting and sending malformed packets to these vulnerable products.
Problem types: description: Improper Input Validation
Affected products: vendor: n/a
product: Quidway S9700,Quidway S9300,Quidway S7700,Quidway S6700,Quidway S6300,Quidway S5700,Quidway S5300 Quidway S9700 V200R003C00SPC500,Quidway S9300 V200R003C00SPC500,Quidway S7700 V200R003C00SPC500,Quidway S6700 V200R003C00SPC300,Quidway S6300 V200R003C00SPC300,Quidway S5700 V200R003C00SPC300,Quidway S5300 V200R003C00SPC300
Published: 2017-04-02T20:00:00.000Z
CVE-2014-3225 
Absolute path traversal vulnerability in the web interface in Cobbler 2.4.x through 2.6.x allows remote authenticated users to read arbitrary files via the Kickstart field in a profile.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-14T00:00:00.000Z
CVE-2014-3227 
dpkg 1.15.9, 1.16.x before 1.16.14, and 1.17.x before 1.17.9 expect the patch program to be compliant with a need for the "C-style encoded filenames" feature, but is supported in environments with noncompliant patch programs, which triggers an interaction error that allows remote attackers to conduct directory traversal attacks and modify files outside of the intended directories via a crafted source package. NOTE: this vulnerability exists because of reliance on unrealistic constraints on the behavior of an external program.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-30T18:00:00.000Z
CVE-2014-3230 
The libwww-perl LWP::Protocol::https module 6.04 through 6.06 for Perl, when using IO::Socket::SSL as the SSL socket class, allows attackers to disable server certificate validation via the (1) HTTPS_CA_DIR or (2) HTTPS_CA_FILE environment variable.
Problem types: description: Other
Affected products: vendor: libwww-perl
product: LWP::Protocol::https
Published: 2020-01-28T15:05:37.000Z
CVE-2014-3242 
SOAPpy 0.12.5 allows remote attackers to read arbitrary files via a SOAP request containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-12T14:00:00.000Z
CVE-2014-3243 
SOAPpy 0.12.5 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted SOAP request containing a large number of nested entity references.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-12T14:00:00.000Z
CVE-2014-3244 
XML external entity (XXE) vulnerability in the RSSDashlet dashlet in SugarCRM before 6.5.17 allows remote attackers to read arbitrary files or potentially execute arbitrary code via a crafted DTD in an XML request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-01T17:00:00.000Z
CVE-2014-3246 
SQL injection vulnerability in Collabtive 1.2 allows remote authenticated users to execute arbitrary SQL commands via the folder parameter in a fileview_list action to manageajax.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-13T14:00:00.000Z
CVE-2014-3247 
Cross-site scripting (XSS) vulnerability in Collabtive 1.2 allows remote authenticated users to inject arbitrary web script or HTML via the desc parameter in an Add project (addpro) action to admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-15T14:00:00.000Z
CVE-2014-3248 
Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before 1.3.4, and Mcollective before 2.5.2, when running with Ruby 1.9.1 or earlier, allows local users to gain privileges via a Trojan horse file in the current working directory, as demonstrated using (1) rubygems/defaults/operating_system.rb, (2) Win32API.rb, (3) Win32API.so, (4) safe_yaml.rb, (5) safe_yaml/deep.rb, or (6) safe_yaml/deep.so; or (7) operatingsystem.rb, (8) operatingsystem.so, (9) osfamily.rb, or (10) osfamily.so in puppet/confine.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-16T17:00:00.000Z
CVE-2014-3249 
Puppet Enterprise 2.8.x before 2.8.7 allows remote attackers to obtain sensitive information via vectors involving hiding and unhiding nodes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-17T14:00:00.000Z
CVE-2014-3250 
The default vhost configuration file in Puppet before 3.6.2 does not include the SSLCARevocationCheck directive, which might allow remote attackers to obtain sensitive information via a revoked certificate when a Puppet master runs with Apache 2.4.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-11T17:00:00.000Z
CVE-2014-3251 
The MCollective aes_security plugin, as used in Puppet Enterprise before 3.3.0 and Mcollective before 2.5.3, does not properly validate new server certificates based on the CA certificate, which allows local users to establish unauthorized Mcollective connections via unspecified vectors related to a race condition.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-12T23:00:00.000Z
CVE-2014-3260 
Pacom 1000 CCU and RTU GMS devices allow remote attackers to spoof the controller-to-base data stream by leveraging improper use of cryptography.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-31T02:00:00.000Z
CVE-2014-3261 
Buffer overflow in the Smart Call Home implementation in Cisco NX-OS on Fabric Interconnects in Cisco Unified Computing System 1.4 before 1.4(1i), NX-OS 5.0 before 5.0(3)U2(2) on Nexus 3000 devices, NX-OS 4.1 before 4.1(2)E1(1l) on Nexus 4000 devices, NX-OS 5.x before 5.1(3)N1(1) on Nexus 5000 devices, NX-OS 5.2 before 5.2(3a) on Nexus 7000 devices, and CG-OS CG4 before CG4(2) on Connected 1000 Connected Grid Routers allows remote SMTP servers to execute arbitrary code via a crafted reply, aka Bug IDs CSCtk00695, CSCts56633, CSCts56632, CSCts56628, CSCug14405, and CSCuf61322.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-24T01:00:00.000Z
CVE-2014-3262 
The Locator/ID Separation Protocol (LISP) implementation in Cisco IOS 15.3(3)S and earlier and IOS XE does not properly validate parameters in ITR control messages, which allows remote attackers to cause a denial of service (CEF outage and packet drops) via malformed messages, aka Bug ID CSCun73782.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-16T10:00:00.000Z
CVE-2014-3263 
The ScanSafe module in Cisco IOS 15.3(3)M allows remote attackers to cause a denial of service (device reload) via HTTPS packets that require tower processing, aka Bug ID CSCum97038.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-16T10:00:00.000Z
CVE-2014-3264 
Cisco Adaptive Security Appliance (ASA) Software 9.1(.5) and earlier allows remote authenticated users to cause a denial of service (device reload) via crafted attributes in a RADIUS packet, aka Bug ID CSCun69561.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-20T10:00:00.000Z
CVE-2014-3265 
Cross-site scripting (XSS) vulnerability in the Auto Update Server (AUS) web framework in Cisco Security Manager 4.2 and earlier allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCuo06900.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-20T10:00:00.000Z