rainbutterfly/cve_corpus huggingface dataset:
CVE-2014-4927 
Buffer overflow in ACME micro_httpd, as used in D-Link DSL2750U and DSL2740U and NetGear WGR614 and MR-ADSL-DG834 routers allows remote attackers to cause a denial of service (crash) via a long string in the URI in a GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-24T14:00:00.000Z
CVE-2014-4928 
SQL injection vulnerability in Invision Power Board (aka IPB or IP.Board) before 3.4.6 allows remote attackers to execute arbitrary SQL commands via the cId parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-20T21:00:00.000Z
CVE-2014-4929 
Directory traversal vulnerability in the routing component in ownCloud Server before 5.0.17 and 6.0.x before 6.0.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in a filename, related to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-20T14:00:00.000Z
CVE-2014-4930 
Multiple cross-site scripting (XSS) vulnerabilities in event/index2.do in ManageEngine EventLog Analyzer before 9.0 build 9002 allow remote attackers to inject arbitrary web script or HTML via the (1) width, (2) height, (3) url, (4) helpP, (5) tab, (6) module, (7) completeData, (8) RBBNAME, (9) TC, (10) rtype, (11) eventCriteria, (12) q, (13) flushCache, or (14) product parameter. Fixed in Build 11072.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-29T14:00:00.000Z
CVE-2014-4932 
Cross-site scripting (XSS) vulnerability in the Wordfence Security plugin before 5.1.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the val parameter to whois.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-28T17:00:00.000Z
CVE-2014-4936 
The upgrade functionality in Malwarebytes Anti-Malware (MBAM) consumer before 2.0.3 and Malwarebytes Anti-Exploit (MBAE) consumer 1.04.1.1012 and earlier allow man-in-the-middle attackers to execute arbitrary code by spoofing the update server and uploading an executable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-16T18:00:00.000Z
CVE-2014-4937 
Directory traversal vulnerability in includes/bookx_export.php BookX plugin 1.7 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-11T20:00:00.000Z
CVE-2014-4938 
SQL injection vulnerability in the WP Rss Poster (wp-rss-poster) plugin 1.0.0 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter in the wrp-add-new page to wp-admin/admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-11T20:00:00.000Z
CVE-2014-4939 
SQL injection vulnerability in the ENL Newsletter (enl-newsletter) plugin 1.0.1 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the id parameter in the enl-add-new page to wp-admin/admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-11T20:00:00.000Z
CVE-2014-4940 
Multiple directory traversal vulnerabilities in Tera Charts (tera-charts) plugin 0.1 for WordPress allow remote attackers to read arbitrary files via a .. (dot dot) in the fn parameter to (1) charts/treemap.php or (2) charts/zoomabletreemap.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-11T20:00:00.000Z
CVE-2014-4941 
Absolute path traversal vulnerability in Cross-RSS (wp-cross-rss) plugin 1.7 for WordPress allows remote attackers to read arbitrary files via a full pathname in the rss parameter to proxy.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-11T20:00:00.000Z
CVE-2014-4942 
The EasyCart (wp-easycart) plugin before 2.0.6 for WordPress allows remote attackers to obtain configuration information via a direct request to inc/admin/phpinfo.php, which calls the phpinfo function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-11T20:00:00.000Z
CVE-2014-4943 
The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the Linux kernel through 3.15.6 allows local users to gain privileges by leveraging data-structure differences between an l2tp socket and an inet socket.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-19T19:00:00.000Z
CVE-2014-4944 
Multiple SQL injection vulnerabilities in inc/bsk-pdf-dashboard.php in the BSK PDF Manager plugin 1.3.2 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) categoryid or (2) pdfid parameter to wp-admin/admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-14T14:00:00.000Z
CVE-2014-4945 
Multiple cross-site scripting (XSS) vulnerabilities in Horde Internet Mail Program (IMP) before 6.1.8, as used in Horde Groupware Webmail Edition before 5.1.5, allow remote attackers to inject arbitrary web script or HTML via an unspecified flag in the basic (1) mailbox or (2) message view.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-14T14:00:00.000Z
CVE-2014-4946 
Multiple cross-site scripting (XSS) vulnerabilities in Horde Internet Mail Program (IMP) before 6.1.8, as used in Horde Groupware Webmail Edition before 5.1.5, allow remote attackers to inject arbitrary web script or HTML via (1) unspecified flags or (2) a mailbox name in the dynamic mailbox view.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-14T14:00:00.000Z
CVE-2014-4947 
Buffer overflow in the HVM graphics console support in Citrix XenServer 6.2 Service Pack 1 and earlier has unspecified impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-22T20:00:00.000Z
CVE-2014-4948 
Unspecified vulnerability in Citrix XenServer 6.2 Service Pack 1 and earlier allows attackers to cause a denial of service and obtain sensitive information by modifying the guest virtual hard disk (VHD).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-22T20:00:00.000Z
CVE-2014-4954 
Cross-site scripting (XSS) vulnerability in the PMA_getHtmlForActionLinks function in libraries/structure.lib.php in phpMyAdmin 4.2.x before 4.2.6 allows remote authenticated users to inject arbitrary web script or HTML via a crafted table comment that is improperly handled during construction of a database structure page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-20T10:00:00.000Z
CVE-2014-4955 
Cross-site scripting (XSS) vulnerability in the PMA_TRI_getRowForList function in libraries/rte/rte_list.lib.php in phpMyAdmin 4.0.x before 4.0.10.1, 4.1.x before 4.1.14.2, and 4.2.x before 4.2.6 allows remote authenticated users to inject arbitrary web script or HTML via a crafted trigger name that is improperly handled on the database triggers page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-20T10:00:00.000Z
CVE-2014-4958 
Cross-site scripting (XSS) vulnerability in Telerik UI for ASP.NET AJAX RadEditor control 2014.1.403.35, 2009.3.1208.20, and other versions allows remote attackers to inject arbitrary web script or HTML via CSS expressions in style attributes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-26T21:00:00.000Z
CVE-2014-4959 
**DISPUTED** SQL injection vulnerability in SQLiteDatabase.java in the SQLi Api in Android allows remote attackers to execute arbitrary SQL commands via the delete method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-27T16:00:00.000Z
CVE-2014-4960 
Multiple SQL injection vulnerabilities in models\gallery.php in Youtube Gallery (com_youtubegallery) component 4.x through 4.1.7, and possibly 3.x, for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) listid or (2) themeid parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-21T14:00:00.000Z
CVE-2014-4962 
Shopizer 1.1.5 and earlier allows remote attackers to reduce the total cost of their shopping cart via a negative number in the productQuantity parameter, which causes the price of the item to be subtracted from the total cost.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-15T14:00:00.000Z
CVE-2014-4963 
Shopizer 1.1.5 and earlier allows remote attackers to modify the account settings of arbitrary users via the customer.customerId parameter to shop/profile/register.action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-15T14:00:00.000Z
CVE-2014-4964 
Multiple cross-site request forgery (CSRF) vulnerabilities in Shopizer 1.1.5 and earlier allow remote attackers to hijack the authentication of users for requests that (1) modify customer settings or hijack the authentication of administrators for requests that change (2) customer passwords, (3) shop configuration, or (4) product details, as demonstrated by (5) modify a product's price via a crafted request to central/catalog/saveproduct.action or (6) creating a product review via a crafted request to shop/product/createReview.action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-15T14:00:00.000Z
CVE-2014-4965 
Multiple cross-site scripting (XSS) vulnerabilities in Shopizer 1.1.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) customername parameter to central/orders/searchcriteria.action; (2) productname, (3) availability, or (4) status parameter to central/catalog/productlist.action; or unspecified vectors in (5) WebContent/orders/orderlist.jsp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-15T14:00:00.000Z
CVE-2014-4966 
Ansible before 1.6.7 does not prevent inventory data with "{{" and "lookup" substrings, and does not prevent remote data with "{{" substrings, which allows remote attackers to execute arbitrary code via (1) crafted lookup('pipe') calls or (2) crafted Jinja2 data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-18T14:46:28.000Z
CVE-2014-4967 
Multiple argument injection vulnerabilities in Ansible before 1.6.7 allow remote attackers to execute arbitrary code by leveraging access to an Ansible managed host and providing a crafted fact, as demonstrated by a fact with (1) a trailing " src=" clause, (2) a trailing " temp=" clause, or (3) a trailing " validate=" clause accompanied by a shell command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-18T14:49:40.000Z
CVE-2014-4968 
The WebView class and use of the WebView.addJavascriptInterface method in the Boat Browser application 8.0 and 8.0.1 for Android allow remote attackers to execute arbitrary code via a crafted web site, a related issue to CVE-2012-6636.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-12T00:19:24.000Z
CVE-2014-4971 
Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, which allows local users to write data to arbitrary memory locations, and consequently gain privileges, via a crafted address in an IOCTL call, related to (1) the MQAC.sys driver in the MQ Access Control subsystem and (2) the BthPan.sys driver in the Bluetooth Personal Area Networking subsystem.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-26T15:00:00.000Z
CVE-2014-4972 
Unrestricted file upload vulnerability in the Gravity Upload Ajax plugin 1.1 and earlier for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file under wp-content/uploads/gravity_forms.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-08T19:00:00.000Z
CVE-2014-4973 
The ESET Personal Firewall NDIS filter (EpFwNdis.sys) driver in the Firewall Module Build 1183 (20140214) and earlier in ESET Smart Security and ESET Endpoint Security products 5.0 through 7.0 allows local users to gain privileges via a crafted argument to a 0x830020CC IOCTL call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-23T15:00:00.000Z
CVE-2014-4974 
The ESET Personal Firewall NDIS filter (EpFwNdis.sys) kernel mode driver, aka Personal Firewall module before Build 1212 (20140609), as used in multiple ESET products 5.0 through 7.0, allows local users to obtain sensitive information from kernel memory via crafted IOCTL calls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-04T16:00:00.000Z
CVE-2014-4975 
Off-by-one error in the encodes function in pack.c in Ruby 1.9.3 and earlier, and 2.x through 2.1.2, when using certain format string specifiers, allows context-dependent attackers to cause a denial of service (segmentation fault) via vectors that trigger a stack-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-15T20:00:00.000Z
CVE-2014-4976 
Dell SonicWall Scrutinizer 11.0.1 allows remote authenticated users to change user passwords via the user ID in the savePrefs parameter in a change password request to cgi-bin/admin.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-16T14:00:00.000Z
CVE-2014-4977 
Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) selectedUserGroup parameter in a create new user request to cgi-bin/admin.cgi or the (2) user_id parameter in the changeUnit function, (3) methodDetail parameter in the methodDetail function, or (4) xcNetworkDetail parameter in the xcNetworkDetail function in d4d/exporters.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-16T14:00:00.000Z
CVE-2014-4978 
The rs_filter_graph function in librawstudio/rs-filter.c in rawstudio might allow local users to truncate arbitrary files via a symlink attack on (1) /tmp/rs-filter-graph.png or (2) /tmp/rs-filter-graph.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-29T22:00:00.000Z
CVE-2014-4979 
Apple QuickTime allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a malformed version number and flags in an mvhd atom.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-26T10:00:00.000Z
CVE-2014-4980 
The /server/properties resource in Tenable Web UI before 2.3.5 for Nessus 5.2.3 through 5.2.7 allows remote attackers to obtain sensitive information via the token parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-23T14:00:00.000Z
CVE-2014-4981 
LPAR2RRD in 3.5 and earlier allows remote attackers to execute arbitrary commands due to insufficient input sanitization of the web GUI parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-17T21:21:42.000Z
CVE-2014-4982 
LPAR2RRD ≤ 4.53 and ≤ 3.5 has arbitrary command injection on the application server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-10T12:56:12.000Z
CVE-2014-4984 
Déjà Vu Crescendo Sales CRM has remote SQL Injection
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-10T12:18:40.000Z
CVE-2014-4986 
Multiple cross-site scripting (XSS) vulnerabilities in js/functions.js in phpMyAdmin 4.0.x before 4.0.10.1, 4.1.x before 4.1.14.2, and 4.2.x before 4.2.6 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) table name or (2) column name that is improperly handled during construction of an AJAX confirmation message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-20T10:00:00.000Z
CVE-2014-4987 
server_user_groups.php in phpMyAdmin 4.1.x before 4.1.14.2 and 4.2.x before 4.2.6 allows remote authenticated users to bypass intended access restrictions and read the MySQL user list via a viewUsers request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-20T10:00:00.000Z
CVE-2014-4991 
(1) lib/dataset/database/mysql.rb and (2) lib/dataset/database/postgresql.rb in the codders-dataset gem 1.3.2.1 for Ruby place credentials on the mysqldump command line, which allows local users to obtain sensitive information by listing the process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-10T18:00:00.000Z
CVE-2014-4992 
lib/cap-strap/helpers.rb in the cap-strap gem 0.1.5 for Ruby places credentials on the useradd command line, which allows local users to obtain sensitive information by listing the process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-10T18:00:00.000Z
CVE-2014-4993 
(1) lib/backup/cli/utility.rb in the backup-agoddard gem 3.0.28 and (2) lib/backup/cli/utility.rb in the backup_checksum gem 3.0.23 for Ruby place credentials on the openssl command line, which allows local users to obtain sensitive information by listing the process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-10T18:00:00.000Z
CVE-2014-4994 
lib/gyazo/client.rb in the gyazo gem 1.0.0 for Ruby allows local users to write to arbitrary files via a symlink attack on a temporary file, related to time-based filenames.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-10T18:00:00.000Z
CVE-2014-4995 
Race condition in lib/vlad/dba/mysql.rb in the VladTheEnterprising gem 0.2 for Ruby allows local users to obtain sensitive information by reading the MySQL root password from a temporary file before it is removed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-10T18:00:00.000Z
CVE-2014-4996 
lib/vlad/dba/mysql.rb in the VladTheEnterprising gem 0.2 for Ruby allows local users to write to arbitrary files via a symlink attack on /tmp/my.cnf.#{target_host}.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-10T18:00:00.000Z
CVE-2014-4997 
lib/commands/setup.rb in the point-cli gem 0.0.1 for Ruby places credentials on the curl command line, which allows local users to obtain sensitive information by listing the process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-10T18:00:00.000Z
CVE-2014-4998 
test/tc_database.rb in the lean-ruport gem 0.3.8 for Ruby places the mysql user password on the mysqldump command line, which allows local users to obtain sensitive information by listing the process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-10T18:00:00.000Z
CVE-2014-4999 
vendor/plugins/dataset/lib/dataset/database/mysql.rb in the kajam gem 1.0.3.rc2 for Ruby places the mysql user password on the (1) mysqldump command line in the capture function and (2) mysql command line in the restore function, which allows local users to obtain sensitive information by listing the process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-10T18:00:00.000Z
CVE-2014-5000 
The login function in lib/lawn.rb in the lawn-login gem 0.0.7 for Ruby places credentials on the curl command line, which allows local users to obtain sensitive information by listing the process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-10T18:00:00.000Z
CVE-2014-5001 
lib/ksymfony1.rb in the kcapifony gem 2.1.6 for Ruby places database user passwords on the (1) mysqldump, (2) pg_dump, (3) mysql, and (4) psql command lines, which allows local users to obtain sensitive information by listing the processes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-10T18:00:00.000Z
CVE-2014-5002 
The lynx gem before 1.0.0 for Ruby places the configured password on command lines, which allows local users to obtain sensitive information by listing processes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-10T18:00:00.000Z
CVE-2014-5003 
chef/travis-cookbooks/ci_environment/perlbrew/recipes/default.rb in the ciborg gem 3.0.0 for Ruby allows local users to write to arbitrary files and gain privileges via a symlink attack on /tmp/perlbrew-installer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-10T18:00:00.000Z
CVE-2014-5004 
lib/brbackup.rb in the brbackup gem 0.1.1 for Ruby places the database password on the mysql command line, which allows local users to obtain sensitive information by listing the process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-10T18:00:00.000Z
CVE-2014-5005 
Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attackers to execute arbitrary code via a .. (dot dot) in the fileName parameter in an LFU action to statusUpdate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-21T15:00:00.000Z
CVE-2014-5006 
Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attackers to execute arbitrary code via a .. (dot dot) in the fileName parameter to mdm/mdmLogUploader.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-21T15:00:00.000Z
CVE-2014-5007 
Directory traversal vulnerability in the agentLogUploader servlet in ZOHO ManageEngine Desktop Central (DC) and Desktop Central Managed Service Providers (MSP) edition before 9 build 90055 allows remote attackers to write to and execute arbitrary files as SYSTEM via a .. (dot dot) in the filename parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-17T21:59:55.000Z
CVE-2014-5008 
Snoopy allows remote attackers to execute arbitrary commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-31T15:00:00.000Z
CVE-2014-5009 
Snoopy allows remote attackers to execute arbitrary commands.  NOTE: this vulnerability exists due to an incomplete fix for CVE-2014-5008.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-31T15:00:00.000Z
CVE-2014-5011 
DOMPDF before 0.6.2 allows Information Disclosure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-10T05:25:20.000Z
CVE-2014-5012 
DOMPDF before 0.6.2 allows denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-10T05:25:09.000Z
CVE-2014-5013 
DOMPDF before 0.6.2 allows remote code execution, a related issue to CVE-2014-2383.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-10T05:25:00.000Z
CVE-2014-5014 
The WordPress Flash Uploader plugin before 3.1.3 for WordPress allows remote attackers to execute arbitrary commands via vectors related to invalid characters in image_magic_path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-25T17:00:00.000Z