rainbutterfly/cve_corpus huggingface dataset:
CVE-2014-5356 
OpenStack Image Registry and Delivery Service (Glance) before 2013.2.4, 2014.x before 2014.1.3, and Juno before Juno-3, when using the V2 API, does not properly enforce the image_size_cap configuration option, which allows remote authenticated users to cause a denial of service (disk consumption) by uploading a large image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-25T14:00:00.000Z
CVE-2014-5359 
Directory traversal vulnerability in SafeNet Authentication Service (SAS) Outlook Web Access Agent (formerly CRYPTOCard) before 1.03.30109 allows remote attackers to read arbitrary files via a .. (dot dot) in the GetFile parameter to owa/owa.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-16T18:00:00.000Z
CVE-2014-5360 
Cross-site scripting (XSS) vulnerability in the admin interface in LANDESK Management Suite before 9.6 SP1 allows remote attackers to inject arbitrary web script or HTML via the AMTVersion parameter to remote/serverlist_grouptree.aspx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-03T16:00:00.000Z
CVE-2014-5361 
Multiple cross-site request forgery (CSRF) vulnerabilities in Landesk Management Suite 9.6 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) start, (2) stop, or (3) restart services via a request to remote/serverServices.aspx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-21T15:00:00.000Z
CVE-2014-5362 
The admin interface in Landesk Management Suite 9.6 and earlier allows remote attackers to conduct remote file inclusion attacks involving ASPX pages from third-party sites via the d parameter to (1) ldms/sm_actionfrm.asp or (2) remote/frm_coremainfrm.aspx; or the (3) top parameter to remote/frm_splitfrm.aspx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-19T15:00:00.000Z
CVE-2014-5368 
Directory traversal vulnerability in the file_get_contents function in downloadfiles/download.php in the WP Content Source Control (wp-source-control) plugin 3.0.0 and earlier for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-22T14:00:00.000Z
CVE-2014-5369 
Enigmail 1.7.x before 1.7.2 sends emails in plaintext when encryption is enabled and only BCC recipients are specified, which allows remote attackers to obtain sensitive information by sniffing the network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-08T14:00:00.000Z
CVE-2014-5370 
Directory traversal vulnerability in the CFChart servlet (com.naryx.tagfusion.cfm.cfchartServlet) in New Atlanta BlueDragon before 7.1.1.18527 allows remote attackers to read or possibly delete arbitrary files via a .. (dot dot) in the QUERY_STRING to cfchart.cfchart.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-21T15:00:00.000Z
CVE-2014-5375 
The server in Adaptive Computing Moab before 7.2.9 and 8 before 8.0.0 does not properly validate the message owner matches the submitting user, which allows remote authenticated users to impersonate arbitrary users via the UserId and Owner tags.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-08T19:00:00.000Z
CVE-2014-5376 
Adaptive Computing Moab before 7.2.9 and 8 before 8.0.0, when a pre-generated key is used, does not validate that the requesting user matches the actor in the message, which allows remote authenticated users to impersonate arbitrary users via the actor field in a message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-08T19:00:00.000Z
CVE-2014-5377 
ReadUsersFromMasterServlet in ManageEngine DeviceExpert before 5.9 build 5981 allows remote attackers to obtain user account credentials via a direct request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-04T17:00:00.000Z
CVE-2014-5380 
Grand MA 300 allows retrieval of the access PIN from sniffed data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-13T12:55:56.000Z
CVE-2014-5381 
Grand MA 300 allows a brute-force attack on the PIN.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-13T13:00:00.000Z
CVE-2014-5382 
Multiple cross-site scripting (XSS) vulnerabilities in the web interface in Schrack Technik microControl with firmware 1.7.0 (937) allow remote attackers to inject arbitrary web script or HTML via the position textbox in the configuration menu or other unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-20T14:00:00.000Z
CVE-2014-5383 
SQL injection vulnerability in AlienVault OSSIM before 4.7.0 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-21T14:00:00.000Z
CVE-2014-5384 
The VIQR module in the iconv implementation in FreeBSD 10.0 before p6 and NetBSD allows context-dependent attackers to cause a denial of service (out-of-bounds array access) via a crafted argument to the iconv_open function.  NOTE: this issue was SPLIT from CVE-2014-3951 per ADT2 due to different vulnerability types.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-21T22:00:00.000Z
CVE-2014-5385 
com/salesmanager/central/profile/ProfileAction.java in Shopizer 1.1.5 and earlier does not restrict the number of authentication attempts, which makes it easier for remote attackers to guess passwords via a brute force attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-21T23:00:00.000Z
CVE-2014-5386 
The mcrypt_create_iv function in hphp/runtime/ext/mcrypt/ext_mcrypt.cpp in Facebook HipHop Virtual Machine (HHVM) before 3.3.0 does not seed the random number generator, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging the use of a single initialization vector.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-28T15:00:00.000Z
CVE-2014-5387 
Multiple SQL injection vulnerabilities in EllisLab ExpressionEngine before 2.9.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) column_filter or (2) category[] parameter to system/index.php or the (3) tbl_sort[0][] parameter in the comment module to system/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-04T15:00:00.000Z
CVE-2014-5388 
Off-by-one error in the pci_read function in the ACPI PCI hotplug interface (hw/acpi/pcihp.c) in QEMU allows local guest users to obtain sensitive information and have other unspecified impact related to a crafted PCI device that triggers memory corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-15T21:00:00.000Z
CVE-2014-5389 
SQL injection vulnerability in content-audit-schedule.php in the Content Audit plugin before 1.6.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the "Audited content types" option in the content-audit page to wp-admin/options-general.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-06T14:00:00.000Z
CVE-2014-5391 
Cross-site scripting (XSS) vulnerability in the JobScheduler Operations Center (JOC) in SOS JobScheduler before 1.6.4246 and 1.7.x before 1.7.4241 allows remote attackers to inject arbitrary web script or HTML via the hash property (location.hash).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-11T15:00:00.000Z
CVE-2014-5392 
XML External Entity (XXE) vulnerability in JobScheduler before 1.6.4246 and 7.x before 1.7.4241 allows remote attackers to cause a denial of service and read arbitrary files or directories via a request containing an XML external entity declaration in conjunction with an entity reference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-23T15:00:00.000Z
CVE-2014-5393 
Directory traversal vulnerability in the JobScheduler Operations Center (JOC) in SOS JobScheduler before 1.6.4246 and 1.7.x before 1.7.4241 allows remote authenticated users with the info permission to read arbitrary files in the webroot via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-11T15:00:00.000Z
CVE-2014-5394 
Multiple Huawei Campus switches allow remote attackers to enumerate usernames via vectors involving use of SSH by the maintenance terminal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-08T19:00:00.000Z
CVE-2014-5395 
Multiple cross-site request forgery (CSRF) vulnerabilities in Huawei HiLink E3276 and E3236 TCPU before V200R002B470D13SP00C00 and WebUI before V100R007B100D03SP01C03, E5180s-22 before 21.270.21.00.00, and E586Bs-2 before 21.322.10.00.889 allow remote attackers to hijack the authentication of users for requests that (1) modify configurations, (2) send SMS messages, or have other unspecified impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-21T15:00:00.000Z
CVE-2014-5396 
The web interface in Schrack Technik microControl with firmware before 1.7.0 (937) has a hardcoded password of not for the "user" account, which makes it easier for remote attackers to obtain access via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-22T14:00:00.000Z
CVE-2014-5397 Schneider Electric Wonderware Cross-site Scripting
Cross-site scripting (XSS) vulnerability in Schneider Electric Wonderware Information Server (WIS) Portal 4.0 SP1 through 5.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: Schneider Electric
product: Wonderware Information Server Portal
default_status: unaffected
Credits: lang: en
value: Timur Yunusov, Ilya Karpov, Sergey Gordeychik, Alexey Osipov, and Dmitry Serebryannikov of the Positive Technologies Research Team
Published: 2014-08-28T01:00:00.000Z
CVE-2014-5398 Schneider Electric Wonderware Input Validation
Schneider Electric Wonderware Information Server (WIS) Portal 4.0 SP1 through 5.5 allows remote attackers to read arbitrary files or cause a denial of service via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: Schneider Electric
product: Wonderware Information Server Portal
default_status: unaffected
Credits: lang: en
value: Timur Yunusov, Ilya Karpov, Sergey Gordeychik, Alexey Osipov, and Dmitry Serebryannikov of the Positive Technologies Research Team
Published: 2014-08-28T01:00:00.000Z
CVE-2014-5399 Schneider Electric Wonderware SQL Injection
SQL injection vulnerability in Schneider Electric Wonderware Information Server (WIS) Portal 4.0 SP1 through 5.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Problem types: cwe_id: CWE-89
description: CWE-89
Affected products: vendor: Schneider Electric
product: Wonderware Information Server Portal
default_status: unaffected
Credits: lang: en
value: Timur Yunusov, Ilya Karpov, Sergey Gordeychik, Alexey Osipov, and Dmitry Serebryannikov of the Positive Technologies Research Team
Published: 2014-08-28T01:00:00.000Z
CVE-2014-5400 Hospira MedNet Password in Configuration File
The installation component in Hospira MedNet before 6.1 places cleartext credentials in configuration files, which allows local users to obtain sensitive information by reading a file.
Problem types: cwe_id: CWE-260
description: CWE-260
Affected products: vendor: Hospira
product: MedNet
default_status: unaffected
Credits: lang: en
value: Billy Rios
Published: 2015-04-03T10:00:00.000Z
CVE-2014-5401 Hospira MedNet Code Injection
Hospira MedNet software version 5.8 and prior uses vulnerable versions of the JBoss Enterprise Application Platform software that may allow unauthenticated users to execute arbitrary code on the target system. Hospira has developed a new version of the MedNet software, MedNet 6.1. Existing versions of MedNet can be upgraded to MedNet 6.1.
Problem types: cwe_id: CWE-94
description: CWE-94
Affected products: vendor: Hospira
product: MedNet
default_status: unaffected
Credits: lang: en
value: Billy Rios
Published: 2019-03-26T16:21:54.000Z
CVE-2014-5403 Hospira MedNet Use of Hard-coded Cryptographic Key
Hospira MedNet before 6.1 uses hardcoded cryptographic keys for protection of data transmission from infusion pumps, which allows remote attackers to obtain sensitive information by sniffing the network.
Problem types: cwe_id: CWE-321
description: CWE-321
Affected products: vendor: Hospira
product: MedNet
default_status: unaffected
Credits: lang: en
value: Billy Rios
Published: 2015-04-03T10:00:00.000Z
CVE-2014-5405 Hospira MedNet Use of Hard-coded Password
Hospira MedNet before 6.1 uses a hardcoded cleartext password to control SQL database authorization, which allows remote authenticated users to bypass intended access restrictions by leveraging knowledge of this password.
Problem types: cwe_id: CWE-259
description: CWE-259
Affected products: vendor: Hospira
product: MedNet
default_status: unaffected
Credits: lang: en
value: Billy Rios
Published: 2015-04-03T10:00:00.000Z
CVE-2014-5406 Hospira LifeCare PCA Infusion System
The Hospira LifeCare PCA Infusion System before 7.0 does not validate network traffic associated with sending a (1) drug library, (2) software update, or (3) configuration change, which allows remote attackers to modify settings or medication data via packets on the (a) TELNET, (b) HTTP, (c) HTTPS, or (d) UPNP port.  NOTE: this issue might overlap CVE-2015-3459.
Problem types: cwe_id: CWE-345
description: CWE-345
Affected products: vendor: Hospira
product: LifeCare PCA Infusion System
default_status: unaffected
Credits: lang: en
value: Billy Rios
Published: 2015-07-06T19:10:00.000Z
CVE-2014-5407 Schneider Electric VAMPSET Stack-based Buffer Overflow
Multiple stack-based buffer overflows in Schneider Electric VAMPSET 2.2.136 and earlier allow local users to cause a denial of service (application halt) via a malformed (1) setting file or (2) disturbance recording file.
Problem types: cwe_id: CWE-121
description: CWE-121
Affected products: vendor: Schneider Electric
product: VAMPSET
default_status: unaffected
Credits: lang: en
value: Aivar Liimets of Martem AS
Published: 2014-09-15T14:00:00.000Z
CVE-2014-5408 Nordex NC2 Cross-site Scripting
Cross-site scripting (XSS) vulnerability in the login script in the Wind Farm Portal on Nordex Control 2 (NC2) SCADA devices 15 and earlier allows remote attackers to inject arbitrary web script or HTML via the username parameter.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: Nordex
product: Nordex Control 2 (NC2) SCADA
default_status: unaffected
Credits: lang: en
value: Darius Freamon
Published: 2014-11-05T11:00:00.000Z
CVE-2014-5409 GE Hydran M2 Predictable Value Range from Previous Values
The 17046 Ethernet card before 94450214LFMT100SEM-L.R3-CL for the GE Digital Energy Hydran M2 does not properly generate random values for TCP Initial Sequence Numbers (ISNs), which makes it easier for remote attackers to spoof packets by predicting these values.
Problem types: cwe_id: CWE-343
description: CWE-343
Affected products: vendor: GE
product: Hydran M2, containing the 17046 Ethernet option
default_status: unaffected
Credits: lang: en
value: Raheem Beyah, David Formby, and San Shin Jung of Georgia Tech
Published: 2015-03-14T01:00:00.000Z
CVE-2014-5410 Rockwell Automation Micrologix 1400 Improper Input Validation
The DNP3 feature on Rockwell Automation Allen-Bradley MicroLogix 1400 1766-Lxxxxx A FRN controllers 7 and earlier and 1400 1766-Lxxxxx B FRN controllers before 15.001 allows remote attackers to cause a denial of service (process disruption) via malformed packets over (1) an Ethernet network or (2) a serial line.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: Rockwell Automation
product: Allen-Bradley MicroLogix 1400
default_status: unaffected
Credits: lang: en
value: Matthew Luallen of CYBATI
Published: 2014-10-03T18:00:00.000Z
CVE-2014-5411 Schneider Electric SCADA Expert ClearSCADA Cross-site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Schneider Electric StruxureWare SCADA Expert ClearSCADA 2010 R3 through 2014 R1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: Schneider Electric
product: ClearSCADA
default_status: unaffected
vendor: Schneider Electric
product: SCADA Expert ClearSCADA
default_status: unaffected
Credits: lang: en
value: Aditya Sood
Published: 2014-09-18T10:00:00.000Z
CVE-2014-5412 Schneider Electric SCADA Expert ClearSCADA Improper Authentication
Schneider Electric StruxureWare SCADA Expert ClearSCADA 2010 R3 through 2014 R1 allows remote attackers to read database records by leveraging access to the guest account.
Problem types: cwe_id: CWE-287
description: CWE-287
Affected products: vendor: Schneider Electric
product: ClearSCADA
default_status: unaffected
vendor: Schneider Electric
product: SCADA Expert ClearSCADA
default_status: unaffected
Credits: lang: en
value: Aditya Sood
Published: 2014-09-18T10:00:00.000Z
CVE-2014-5413 Schneider Electric SCADA Expert ClearSCADA Cryptographic Issues
Schneider Electric StruxureWare SCADA Expert ClearSCADA 2010 R3 through 2014 R1 uses the MD5 algorithm for an X.509 certificate, which makes it easier for remote attackers to spoof servers via a cryptographic attack against this algorithm.
Problem types: cwe_id: CWE-310
description: CWE-310
Affected products: vendor: Schneider Electric
product: ClearSCADA
default_status: unaffected
vendor: Schneider Electric
product: SCADA Expert ClearSCADA
default_status: unaffected
Credits: lang: en
value: Aditya Sood
Published: 2014-09-18T10:00:00.000Z
CVE-2014-5414 Beckhoff Embedded PC Images and TwinCAT Components Improper Restriction of Excessive Authentication Attempts
Beckhoff Embedded PC images before 2014-10-22 and Automation Device Specification (ADS) TwinCAT components do not restrict the number of authentication attempts, which makes it easier for remote attackers to obtain access via a brute-force attack.
Problem types: cwe_id: CWE-307
description: CWE-307
Affected products: vendor: Beckhoff
product: Embedded PC Images
default_status: unaffected
vendor: Beckhoff
product: TwinCAT Components featuring Automation Device Specification (ADS) communication
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: Gregor Bonney from FH Aachen University of Applied Sciences
Published: 2016-10-05T10:00:00.000Z
CVE-2014-5415 Beckhoff Embedded PC Images and TwinCAT Components Exposed Dangerous Method or Function
Beckhoff Embedded PC images before 2014-10-22 and Automation Device Specification (ADS) TwinCAT components might allow remote attackers to obtain access via the (1) Windows CE Remote Configuration Tool, (2) CE Remote Display service, or (3) TELNET service.
Problem types: cwe_id: CWE-749
description: CWE-749
Affected products: vendor: Beckhoff
product: Embedded PC Images
default_status: unaffected
vendor: Beckhoff
product: TwinCAT Components featuring Automation Device Specification (ADS) communication
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: Gregor Bonney from FH Aachen University of Applied Sciences
Published: 2016-10-05T10:00:00.000Z
CVE-2014-5417 Meinberg Radio Clocks LANTIME M-Series
Cross-site scripting (XSS) vulnerability in Meinberg NTP Server firmware on LANTIME M-Series devices 6.15.019 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: Meinberg Radio Clocks
product: LANTIME M-Series
default_status: unaffected
Credits: lang: en
value: Martem Telecontrol Systems security researcher Aivar Liimets
Published: 2014-11-05T11:00:00.000Z
CVE-2014-5418 GE Multilink Uncontrolled Resource Consumption
GE Multilink ML800, ML1200, ML1600, and ML2400 switches with firmware 4.2.1 and earlier and Multilink ML810, ML3000, and ML3100 switches with firmware 5.2.0 and earlier allow remote attackers to cause a denial of service (resource consumption or reboot) via crafted packets.
Problem types: cwe_id: CWE-400
description: CWE-400
Affected products: vendor: GE
product: Multilink ML800/1200/1600/2400
default_status: unaffected
vendor: GE
product: ML810/3000/3100 series switch
default_status: unaffected
Credits: lang: en
value: Eireann Leverett of IOActive
Published: 2015-01-17T02:00:00.000Z
CVE-2014-5419 GE Multilink Use of Hard-coded Cryptographic Key
GE Multilink ML800, ML1200, ML1600, and ML2400 switches with firmware 4.2.1 and earlier and Multilink ML810, ML3000, and ML3100 switches with firmware 5.2.0 and earlier use the same RSA private key across different customers' installations, which makes it easier for remote attackers to obtain the cleartext content of network traffic by reading this key from a firmware image and then sniffing the network.
Problem types: cwe_id: CWE-321
description: CWE-321
Affected products: vendor: GE
product: Multilink ML800/1200/1600/2400
default_status: unaffected
vendor: GE
product: ML810/3000/3100 series switch
default_status: unaffected
Credits: lang: en
value: Eireann Leverett of IOActive
Published: 2015-01-17T02:00:00.000Z
CVE-2014-5420 
CareFusion Pyxis SupplyStation 8.1 with hardware test tool before 1.0.16 has a hardcoded application password, which makes it easier for remote authenticated users to obtain application-file access via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-19T01:00:00.000Z
CVE-2014-5421 
CareFusion Pyxis SupplyStation 8.1 with hardware test tool 1.0.16 and earlier has a hardcoded database password, which makes it easier for local users to gain privileges by leveraging cabinet access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-19T01:00:00.000Z
CVE-2014-5422 
CareFusion Pyxis SupplyStation 8.1 with hardware test tool before 1.0.16 has a hardcoded service password, which makes it easier for remote attackers to obtain access via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-19T01:00:00.000Z
CVE-2014-5423 
CareFusion Pyxis SupplyStation 8.1 with hardware test tool before 1.0.16 allows local users to obtain potentially sensitive information by reading a temporary (1) debugging file or (2) developer file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-19T01:00:00.000Z