rainbutterfly/cve_corpus huggingface dataset:
CVE-2014-5111 
Multiple directory traversal vulnerabilities in Fonality trixbox allow remote attackers to read arbitrary files via a .. (dot dot) in the lang parameter to (1) home/index.php, (2) asterisk_info/asterisk_info.php, (3) repo/repo.php, or (4) endpointcfg/endpointcfg.php in maint/modules/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-28T15:00:00.000Z
CVE-2014-5112 
maint/modules/home/index.php in Fonality trixbox allows remote attackers to execute arbitrary commands via shell metacharacters in the lang parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-28T15:00:00.000Z
CVE-2014-5113 
Multiple cross-site scripting (XSS) vulnerabilities in test.php in Visualware MyConnection Server 9.7i allow remote attackers to inject arbitrary web script or HTML via the (1) testtype, (2) ver, (3) cm, (4) map, (5) lines, (6) pps, (7) bpp, (8) codec, (9) provtext, (10) provtextextra, (11) provlink, or (12) duration parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-28T15:00:00.000Z
CVE-2014-5114 
WeBid 1.1.1 allows remote attackers to conduct an LDAP injection attack via the (1) js or (2) cat parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-29T14:00:00.000Z
CVE-2014-5115 
Absolute path traversal vulnerability in DirPHP 1.0 allows remote attackers to read arbitrary files via a full pathname in the phpfile parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-29T14:00:00.000Z
CVE-2014-5116 
The cairo_image_surface_get_data function in Cairo 1.10.2, as used in GTK+ and Wireshark, allows context-dependent attackers to cause a denial of service (NULL pointer dereference) via a large string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-29T14:00:00.000Z
CVE-2014-5117 
Tor before 0.2.4.23 and 0.2.5 before 0.2.5.6-alpha maintains a circuit after an inbound RELAY_EARLY cell is received by a client, which makes it easier for remote attackers to conduct traffic-confirmation attacks by using the pattern of RELAY and RELAY_EARLY cells as a means of communicating information about hidden service names.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-30T16:00:00.000Z
CVE-2014-5118 
Trusted Boot (tboot) before 1.8.2 has a 'loader.c' Security Bypass Vulnerability
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-18T22:03:43.000Z
CVE-2014-5119 
Off-by-one error in the __gconv_translit_find function in gconv_trans.c in GNU C Library (aka glibc) allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via vectors related to the CHARSET environment variable and gconv transliteration modules.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-29T17:00:00.000Z
CVE-2014-5120 
gd_ctx.c in the GD component in PHP 5.4.x before 5.4.32 and 5.5.x before 5.5.16 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to overwrite arbitrary files via crafted input to an application that calls the (1) imagegd, (2) imagegd2, (3) imagegif, (4) imagejpeg, (5) imagepng, (6) imagewbmp, or (7) imagewebp function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-23T01:00:00.000Z
CVE-2014-5121 
Multiple cross-site scripting (XSS) vulnerabilities in ESRI ArcGIS for Server 10.1.1 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-22T14:00:00.000Z
CVE-2014-5122 
Open redirect vulnerability in ESRI ArcGIS for Server 10.1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via an unspecified parameter, related to login.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-22T14:00:00.000Z
CVE-2014-5127 
Open redirect vulnerability in Innovative Interfaces Encore Discovery Solution 4.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in an unspecified parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-29T14:00:00.000Z
CVE-2014-5128 
Innovative Interfaces Encore Discovery Solution 4.3 places a session token in the URI, which might allow remote attackers to obtain sensitive information via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-29T14:00:00.000Z
CVE-2014-5129 
Cross-site scripting (XSS) vulnerability in Avolve Software ProjectDox 8.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-11T15:00:00.000Z
CVE-2014-5130 
Avolve Software ProjectDox 8.1 allows remote authenticated users to obtain sensitive information from other users via vectors involving a direct access token.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-27T21:00:00.000Z
CVE-2014-5131 
Avolve Software ProjectDox 8.1 makes it easier for remote authenticated users to obtain sensitive information by leveraging ciphertext reuse.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-27T21:00:00.000Z
CVE-2014-5132 
Avolve Software ProjectDox 8.1 allows remote attackers to enumerate users via vectors related to email addresses.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-27T21:00:00.000Z
CVE-2014-5136 
Cross-site scripting (XSS) vulnerability in Innovative Interfaces Sierra Library Services Platform 1.2_3 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-02T14:00:00.000Z
CVE-2014-5137 
Innovative Interfaces Sierra Library Services Platform 1.2_3 provides different responses for login request depending on whether the user account exists, which allows remote attackers to enumerate account names via a series of login requests, possibly related to the Webpac Pro submodule.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-02T14:00:00.000Z
CVE-2014-5138 
Innovative Interfaces Sierra Library Services Platform 1.2_3 does not properly handle query strings with multiple instances of the same parameter, which allows remote attackers to bypass parameter validation via unspecified vectors, possibly related to the Webpac Pro submodule.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-14T15:49:00.000Z
CVE-2014-5139 
The ssl_set_client_disabled function in t1_lib.c in OpenSSL 1.0.1 before 1.0.1i allows remote SSL servers to cause a denial of service (NULL pointer dereference and client application crash) via a ServerHello message that includes an SRP ciphersuite without the required negotiation of that ciphersuite with the client.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-13T23:00:00.000Z
CVE-2014-5140 
The bindReplace function in the query factory in includes/classes/database.php in Loaded Commerce 7 does not properly handle : (colon) characters, which allows remote authenticated users to conduct SQL injection attacks via the First name and Last name fields in the address book.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-03T19:50:52.000Z
CVE-2014-5144 
Cross-site scripting (XSS) vulnerability in Telescope before 0.9.3 allows remote authenticated users to inject arbitrary web script or HTML via crafted markdown.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-09T18:00:00.000Z
CVE-2014-5146 
Certain MMU virtualization operations in Xen 4.2.x through 4.4.x before the xsa97-hap patch, when using Hardware Assisted Paging (HAP), are not preemptible, which allows local HVM guest to cause a denial of service (vcpu consumption) by invoking these operations, which process every page assigned to a guest, a different vulnerability than CVE-2014-5149.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-22T14:00:00.000Z
CVE-2014-5147 
Xen 4.4.x, when running a 64-bit kernel on an ARM system, does not properly handle traps from the guest domain that use a different address width, which allows local guest users to cause a denial of service (host crash) via a crafted 32-bit process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-29T17:00:00.000Z
CVE-2014-5148 
Xen 4.4.x, when running on an ARM system and "handling an unknown system register access from 64-bit userspace," returns to an instruction of the trap handler for kernel space faults instead of an instruction that is associated with faults in 64-bit userspace, which allows local guest users to cause a denial of service (crash) and possibly gain privileges via a crafted process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-26T20:00:00.000Z
CVE-2014-5149 
Certain MMU virtualization operations in Xen 4.2.x through 4.4.x, when using shadow pagetables, are not preemptible, which allows local HVM guest to cause a denial of service (vcpu consumption) by invoking these operations, which process every page assigned to a guest, a different vulnerability than CVE-2014-5146.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-22T14:00:00.000Z
CVE-2014-5158 
The (1) av-centerd SOAP service and (2) backup command in the ossim-framework service in AlienVault OSSIM before 4.6.0 allows remote attackers to execute arbitrary commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-21T14:00:00.000Z
CVE-2014-5159 
SQL injection vulnerability in the ossim-framework service in AlienVault OSSIM before 4.6.0 allows remote attackers to execute arbitrary SQL commands via the ws_data parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-21T14:00:00.000Z
CVE-2014-5160 
Multiple directory traversal vulnerabilities in crs.exe in the Cell Request Service in HP Data Protector allow remote attackers to create arbitrary files via an opcode-1091 request, or create or delete arbitrary files via an opcode-305 request.  NOTE: the vendor reportedly asserts that this behavior is "by design.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-01T10:00:00.000Z
CVE-2014-5161 
The dissect_log function in plugins/irda/packet-irda.c in the IrDA dissector in Wireshark 1.10.x before 1.10.9 does not properly strip '\n' characters, which allows remote attackers to cause a denial of service (buffer underflow and application crash) via a crafted packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-01T10:00:00.000Z
CVE-2014-5162 
The read_new_line function in wiretap/catapult_dct2000.c in the Catapult DCT2000 dissector in Wireshark 1.10.x before 1.10.9 does not properly strip '\n' and '\r' characters, which allows remote attackers to cause a denial of service (off-by-one buffer underflow and application crash) via a crafted packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-01T10:00:00.000Z
CVE-2014-5163 
The APN decode functionality in (1) epan/dissectors/packet-gtp.c and (2) epan/dissectors/packet-gsm_a_gm.c in the GTP and GSM Management dissectors in Wireshark 1.10.x before 1.10.9 does not completely initialize a certain buffer, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-01T10:00:00.000Z
CVE-2014-5164 
The rlc_decode_li function in epan/dissectors/packet-rlc.c in the RLC dissector in Wireshark 1.10.x before 1.10.9 initializes a certain structure member only after this member is used, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-01T10:00:00.000Z
CVE-2014-5165 
The dissect_ber_constrained_bitstring function in epan/dissectors/packet-ber.c in the ASN.1 BER dissector in Wireshark 1.10.x before 1.10.9 does not properly validate padding values, which allows remote attackers to cause a denial of service (buffer underflow and application crash) via a crafted packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-01T10:00:00.000Z
CVE-2014-5169 
Cross-site scripting (XSS) vulnerability in the Date module before 7.x-2.8 for Drupal allows remote authenticated users with the permission to create a date field to inject arbitrary web script or HTML via the date field title.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-20T17:00:00.000Z
CVE-2014-5170 
The Storage API module 7.x before 7.x-1.6 for Drupal might allow remote attackers to execute arbitrary code by leveraging failure to update .htaccess file contents after SA-CORE-2013-003.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-29T18:00:00.000Z
CVE-2014-5171 
SAP HANA Extend Application Services (XS) does not encrypt transmissions for applications that enable form based authentication using SSL, which allows remote attackers to obtain credentials and other sensitive information by sniffing the network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-31T14:00:00.000Z
CVE-2014-5172 
Multiple cross-site scripting (XSS) vulnerabilities in the XS Administration Tools in SAP HANA allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-31T14:00:00.000Z
CVE-2014-5173 
SAP HANA Extend Application Services (XS) allows remote attackers to bypass access restrictions via a request to a private IU5 SDK application that was once public.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-31T14:00:00.000Z
CVE-2014-5174 
The SAP Netweaver Business Warehouse component does not properly restrict access to the functions in the BW-SYS-DB-DB4 function group, which allows remote authenticated users to obtain sensitive information via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-31T14:00:00.000Z
CVE-2014-5175 
The License Measurement servlet in SAP Solution Manager 7.1 allows remote attackers to bypass authentication via unspecified vectors, related to a verb tampering attack and SAP_JTECHS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-31T14:00:00.000Z
CVE-2014-5176 
SAP FI Manager Self-Service has a hard-coded user name, which makes it easier for remote attackers to obtain access via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-31T14:00:00.000Z
CVE-2014-5177 
libvirt 1.0.0 through 1.2.x before 1.2.5, when fine grained access control is enabled, allows local users to read arbitrary files via a crafted XML document containing an XML external entity declaration in conjunction with an entity reference to the (1) virDomainDefineXML, (2) virNetworkCreateXML, (3) virNetworkDefineXML, (4) virStoragePoolCreateXML, (5) virStoragePoolDefineXML, (6) virStorageVolCreateXML, (7) virDomainCreateXML, (8) virNodeDeviceCreateXML, (9) virInterfaceDefineXML, (10) virStorageVolCreateXMLFrom, (11) virConnectDomainXMLFromNative, (12) virConnectDomainXMLToNative, (13) virSecretDefineXML, (14) virNWFilterDefineXML, (15) virDomainSnapshotCreateXML, (16) virDomainSaveImageDefineXML, (17) virDomainCreateXMLWithFiles, (18) virConnectCompareCPU, or (19) virConnectBaselineCPU API method, related to an XML External Entity (XXE) issue.  NOTE: this issue was SPLIT from CVE-2014-0179 per ADT3 due to different affected versions of some vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-03T18:00:00.000Z
CVE-2014-5178 
Multiple cross-site scripting (XSS) vulnerabilities in Easy File Sharing (EFS) Web Server 6.8 allow remote authenticated users to inject arbitrary web script or HTML via the content parameter when (1) creating a topic or (2) posting an answer.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-06T18:00:00.000Z
CVE-2014-5179 
The freelinking module for Drupal, as used in the Freelinking for Case Tracker module, does not properly check access permissions for (1) nodes or (2) users, which allows remote attackers to obtain sensitive information via a crafted link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-06T18:00:00.000Z
CVE-2014-5180 
SQL injection vulnerability in the videos page in the HDW Player Plugin (hdw-player-video-player-video-gallery) 2.4.2 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the id parameter in the edit action to wp-admin/admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-06T19:00:00.000Z
CVE-2014-5181 
Directory traversal vulnerability in lastfm-proxy.php in the Last.fm Rotation (lastfm-rotation) plugin 1.0 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the snode parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-06T19:00:00.000Z
CVE-2014-5182 
Multiple SQL injection vulnerabilities in the yawpp plugin 1.2 for WordPress allow remote authenticated users with Contributor privileges to execute arbitrary SQL commands via vectors related to (1) admin_functions.php or (2) admin_update.php, as demonstrated by the id parameter in the update action to wp-admin/admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-06T19:00:00.000Z
CVE-2014-5183 
SQL injection vulnerability in includes/mode-edit.php in the Simple Retail Menus (simple-retail-menus) plugin before 4.1 for WordPress allows remote authenticated editors to execute arbitrary SQL commands via the targetmenu parameter in an edit action to wp-admin/admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-06T19:00:00.000Z
CVE-2014-5184 
SQL injection vulnerability in the stripshow-storylines page in the stripShow plugin 2.5.2 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the story parameter in an edit action to wp-admin/admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-06T19:00:00.000Z
CVE-2014-5185 
SQL injection vulnerability in the Quartz plugin 1.01.1 for WordPress allows remote authenticated users with Contributor privileges to execute arbitrary SQL commands via the quote parameter in an edit action in the quartz/quote_form.php page to wp-admin/edit.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-06T19:00:00.000Z
CVE-2014-5186 
SQL injection vulnerability in the All Video Gallery (all-video-gallery) plugin 1.2 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the id parameter in an edit action in the allvideogallery_videos page to wp-admin/admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-06T19:00:00.000Z
CVE-2014-5187 
Directory traversal vulnerability in the Tom M8te (tom-m8te) plugin 1.5.3 for WordPress allows remote attackers to read arbitrary files via the file parameter to tom-download-file.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-06T19:00:00.000Z
CVE-2014-5188 
Cross-site scripting (XSS) vulnerability in doemailpassword.tml in Lyris ListManager (LM) 8.95a allows remote attackers to inject arbitrary web script or HTML via the EmailAddr parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-07T10:00:00.000Z
CVE-2014-5189 
SQL injection vulnerability in lib/optin/optin_page.php in the Lead Octopus plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-07T10:00:00.000Z
CVE-2014-5190 
Cross-site scripting (XSS) vulnerability in captcha-secureimage/test/index.php in the SI CAPTCHA Anti-Spam plugin 2.7.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-07T10:00:00.000Z
CVE-2014-5191 
Cross-site scripting (XSS) vulnerability in the Preview plugin before 4.4.3 in CKEditor allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-07T10:00:00.000Z
CVE-2014-5192 
SQL injection vulnerability in admin/admin.php in Sphider 1.3.6 allows remote attackers to execute arbitrary SQL commands via the filter parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-07T10:00:00.000Z
CVE-2014-5193 
Cross-site scripting (XSS) vulnerability in admin/admin.php in Sphider 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the category parameter.  NOTE: the url parameter vector is already covered by CVE-2014-5082.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-07T10:00:00.000Z
CVE-2014-5194 
Static code injection vulnerability in admin/admin.php in Sphider 1.3.6 allows remote authenticated users to inject arbitrary PHP code into settings/conf.php via the _word_upper_bound parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-07T10:00:00.000Z
CVE-2014-5195 
Unity before 7.2.3 and 7.3.x before 7.3.1, as used in Ubuntu, does not properly take focus of the keyboard when switching to the lock screen, which allows physically proximate attackers to bypass the lock screen by (1) leveraging a machine that had text selected when locking or (2) resuming from a suspension.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-07T10:00:00.000Z
CVE-2014-5196 
Cross-site request forgery (CSRF) vulnerability in improved-user-search-in-backend.php in the backend in the Improved user search in backend plugin before 1.2.5 for WordPress allows remote attackers to hijack the authentication of administrators for requests that insert XSS sequences via the iusib_meta_fields parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-12T20:00:00.000Z
CVE-2014-5197 
Directory traversal vulnerability in (1) Splunk Web or the (2) Splunkd HTTP Server in Splunk Enterprise 6.1.x before 6.1.3 allows remote authenticated users to read arbitrary files via a .. (dot dot) in a URI, related to search ids.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-12T20:00:00.000Z