rainbutterfly/cve_corpus huggingface dataset:
CVE-2014-7119 
The GNAM 2013 (aka com.beepeers.gndam) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-19T10:00:00.000Z
CVE-2014-7120 
The Model Laboratory (aka com.magazinecloner.modellaboratory) application @7F080193 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-19T10:00:00.000Z
CVE-2014-7121 
The Dhanam (aka com.magzter.dhanam) application 3.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-19T10:00:00.000Z
CVE-2014-7122 
The Lansing State Journal Print (aka com.lansingjournal.android.prod) application 6.7 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-19T10:00:00.000Z
CVE-2014-7123 
The Brevir Harian V2 (aka com.brevir.harian.v) application 2.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-19T10:00:00.000Z
CVE-2014-7124 
The IP Alarm (aka com.cosesy.gadget.alarm) application 1.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-19T10:00:00.000Z
CVE-2014-7125 
The Motor (aka com.magzter.motorhwpublishing) application 3.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-19T10:00:00.000Z
CVE-2014-7127 
The Football Espana magazine (aka com.triactivemedia.footballespana) application @7F0801AA for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-19T10:00:00.000Z
CVE-2014-7128 
The Toyota OC (aka com.tapatalk.toyotaownersclubcomforums) application 3.6.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-19T10:00:00.000Z
CVE-2014-7129 
The Argus Leader Print Edition (aka com.argusleader.android.prod) application 6.7 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-19T10:00:00.000Z
CVE-2014-7131 
The Digital Content NewFronts 2014 (aka com.coreapps.android.followme.newfronts2014) application 6.0.7.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-19T10:00:00.000Z
CVE-2014-7132 
The Jambatan PBB Semporna (aka com.wJAMBATANPBBSEMPORNA) application 13523.82613 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-19T10:00:00.000Z
CVE-2014-7134 
The PROF. USMAN ALI AWHEELA (aka com.wPROFUAAWHEELA) application 2.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-19T10:00:00.000Z
CVE-2014-7135 
The Ayuntamiento de Coana (aka com.wInfoCoa) application 0.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-19T10:00:00.000Z
CVE-2014-7136 
Heap-based buffer overflow in the K7FWFilt.sys kernel mode driver (aka K7Firewall Packet Driver) before 14.0.1.16, as used in multiple K7 Computing products, allows local users to execute arbitrary code with kernel privileges via a crafted parameter in a DeviceIoControl API call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-12T15:00:00.000Z
CVE-2014-7137 
Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM before 3.6.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) contactid parameter in an addcontact action, (2) ligne parameter in a swapstatut action, or (3) project_ref parameter to projet/tasks/contact.php; (4) lineid parameter in a deletecontact action, (5) ligne parameter in a swapstatut action, or (6) ref parameter to projet/contact.php; (7) id parameter to compta/bank/fiche.php, (8) contact/info.php, (9) holiday/index.php, (10) product/stock/fiche.php, (11) product/stock/info.php, or (12) in an edit action to product/stock/fiche.php; (13) productid parameter in an addline action to product/stock/massstockmove.php; (14) project_ref parameter to projet/tasks/note.php; (15) ref parameter to element.php, (16) ganttview.php, (17) note.php, or (18) tasks.php in projet/; (19) sall or (20) sref parameter to comm/mailing/liste.php; (21) search_bon, (22) search_ligne, (23) search_societe, or (24) search_code parameter to compta/prelevement/liste.php; (25) search_label parameter to compta/sociales/index.php; (26) search_project parameter to projet/tasks/index.php; (27) search_societe parameter to compta/prelevement/demandes.php; (28) search_statut parameter to user/index.php; (29) socid parameter to compta/recap-compta.php, (30) societe/commerciaux.php, or (31) societe/rib.php; (32) sortorder, (33) sref, (34) sall, or (35) sortfield parameter to product/stock/liste.php; (36) statut parameter to adherents/liste.php or (37) compta/dons/liste.php; (38) tobuy or (39) tosell parameter to product/liste.php; (40) tobuy, (41) tosell, (42) search_categ, or (43) sref parameter to product/reassort.php; (44) type parameter to product/index.php; or the (a) sortorder or (b) sortfield parameter to (45) compta/paiement/cheque/liste.php, (46) compta/prelevement/bons.php, (47) compta/prelevement/rejets.php, (48) product/stats/commande.php, (49) product/stats/commande_fournisseur.php, (50) product/stats/contrat.php, (51) product/stats/facture.php, (52) product/stats/facture_fournisseur.php, (53) product/stats/propal.php, or (54) product/stock/replenishorders.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-21T15:00:00.000Z
CVE-2014-7138 
Cross-site scripting (XSS) vulnerability in the Google Calendar Events plugin before 2.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the gce_feed_ids parameter in a gce_ajax action to wp-admin/admin-ajax.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-16T19:00:00.000Z
CVE-2014-7139 
Multiple cross-site scripting (XSS) vulnerabilities in the Contact Form DB (aka CFDB and contact-form-7-to-database-extension) plugin before 2.8.16 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) form or (2) enc parameter in the CF7DBPluginShortCodeBuilder page to wp-admin/admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-10T14:00:00.000Z
CVE-2014-7140 
Unspecified vulnerability in the management interface in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 10.x before 10.1-129.11 and 10.5 before 10.5-50.10 allows remote attackers to execute arbitrary code via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-21T14:00:00.000Z
CVE-2014-7141 
The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and crash) via a crafted type in an (1) ICMP or (2) ICMP6 packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-26T15:00:00.000Z
CVE-2014-7142 
The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (crash) via a crafted (1) ICMP or (2) ICMP6 packet size.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-26T15:00:00.000Z
CVE-2014-7143 
Python Twisted 14.0 trustRoot is not respected in HTTP client
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-12T13:04:24.000Z
CVE-2014-7144 
OpenStack keystonemiddleware (formerly python-keystoneclient) 0.x before 0.11.0 and 1.x before 1.2.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-02T14:00:00.000Z
CVE-2014-7145 
The SMB2_tcon function in fs/cifs/smb2pdu.c in the Linux kernel before 3.16.3 allows remote CIFS servers to cause a denial of service (NULL pointer dereference and client system crash) or possibly have unspecified other impact by deleting the IPC$ share during resolution of DFS referrals.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-28T10:00:00.000Z
CVE-2014-7146 
The XmlImportExport plugin in MantisBT 1.2.17 and earlier allows remote attackers to execute arbitrary PHP code via a crafted (1) description field or (2) issuelink attribute in an XML file, which is not properly handled when executing the preg_replace function with the e modifier.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-18T15:00:00.000Z
CVE-2014-7151 
Multiple cross-site scripting (XSS) vulnerabilities in the NEX-Forms Lite plugin 2.1.0 for WordPress allow remote attackers to inject arbitrary web script or HTML via the form_fields parameter in a (1) do_edit or (2) do_insert action to wp-admin/admin-ajax.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-01-08T21:00:00.000Z
CVE-2014-7152 
Cross-site scripting (XSS) vulnerability in the Easy MailChimp Forms plugin 3.0 through 5.0.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the update_options action to wp-admin/admin-ajax.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-26T21:00:00.000Z
CVE-2014-7153 
SQL injection vulnerability in the editgallery function in admin/gallery_func.php in the Huge-IT Image Gallery plugin 1.0.1 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the removeslide parameter to wp-admin/admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-22T14:00:00.000Z
CVE-2014-7154 
Race condition in HVMOP_track_dirty_vram in Xen 4.0.0 through 4.4.x does not ensure possession of the guarding lock for dirty video RAM tracking, which allows certain local guest domains to cause a denial of service via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-02T14:00:00.000Z
CVE-2014-7155 
The x86_emulate function in arch/x86/x86_emulate/x86_emulate.c in Xen 4.4.x and earlier does not properly check supervisor mode permissions, which allows local HVM users to cause a denial of service (guest crash) or gain guest kernel mode privileges via vectors involving an (1) HLT, (2) LGDT, (3) LIDT, or (4) LMSW instruction.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-02T14:00:00.000Z
CVE-2014-7156 
The x86_emulate function in arch/x86/x86_emulate/x86_emulate.c in Xen 3.3.x through 4.4.x does not check the supervisor mode permissions for instructions that generate software interrupts, which allows local HVM guest users to cause a denial of service (guest crash) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-02T14:00:00.000Z
CVE-2014-7157 
Cross-site scripting (XSS) vulnerability in Exinda WAN Optimization Suite 7.0.0 (2160) allows remote attackers to inject arbitrary web script or HTML via the tabsel parameter to admin/launch.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-02T14:00:00.000Z
CVE-2014-7158 
Cross-site request forgery (CSRF) vulnerability in Exinda WAN Optimization Suite 7.0.0 (2160) allows remote attackers to hijack the authentication of administrators for requests that change the admin password via a request to admin/launch.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-02T14:00:00.000Z
CVE-2014-7169 
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-25T01:00:00.000Z
CVE-2014-7170 
Race condition in Puppet Server 0.2.0 allows local users to obtain sensitive information by accessing it in between package installation or upgrade and the start of the service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-17T19:00:00.000Z
CVE-2014-7173 
FarLinX X25 Gateway through 2014-09-25 allows command injection via shell metacharacters to sysSaveMonitorData.php, fsx25MonProxy.php, syseditdate.php, iframeupload.php, or sysRestoreX25Cplt.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-01T16:43:48.000Z
CVE-2014-7174 
FarLinX X25 Gateway through 2014-09-25 allows directory traversal via the log-handling feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-01T16:42:02.000Z
CVE-2014-7175 
FarLinX X25 Gateway through 2014-09-25 allows attackers to write arbitrary data to fsUI.xyz via fsSaveUIPersistence.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-01T16:42:50.000Z
CVE-2014-7176 
SQL injection vulnerability in Enalean Tuleap before 7.5.99.4 allows remote authenticated users to execute arbitrary SQL commands via the lobal_txt parameter to plugins/docman.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-04T15:00:00.000Z
CVE-2014-7177 
XML External Entity vulnerability in Enalean Tuleap 7.2 and earlier allows remote authenticated users to read arbitrary files via a crafted xml document in a create action to plugins/tracker/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-31T14:00:00.000Z
CVE-2014-7178 
Enalean Tuleap before 7.5.99.6 allows remote attackers to execute arbitrary commands via the User-Agent header, which is provided to the passthru PHP function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-28T15:00:00.000Z
CVE-2014-7180 
Electric Cloud ElectricCommander before 4.2.6 and 5.x before 5.0.3 uses world-writable permissions for (1) eccert.pl and (2) ecconfigure.pl, which allows local users to execute arbitrary Perl code by modifying these files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-25T00:00:00.000Z
CVE-2014-7181 
Cross-site scripting (XSS) vulnerability in the Max Foundry MaxButtons plugin before 1.26.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter in a button action on the maxbuttons-controller page to wp-admin/admin.php, related to the button creation page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-16T19:00:00.000Z
CVE-2014-7182 
Multiple cross-site scripting (XSS) vulnerabilities in the WP Google Maps plugin before 6.0.27 for WordPress allow remote attackers to inject arbitrary web script or HTML via the poly_id parameter in an (1) edit_poly, (2) edit_polyline, or (3) edit_marker action in the wp-google-maps-menu page to wp-admin/admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-22T14:00:00.000Z
CVE-2014-7183 
Multiple cross-site scripting (XSS) vulnerabilities in the search.php in LiteCart 1.1.2.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) query parameter or (2) QUERY_STRING.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-22T14:00:00.000Z
CVE-2014-7185 
Integer overflow in bufferobject.c in Python before 2.7.8 allows context-dependent attackers to obtain sensitive information from process memory via a large size and offset in a "buffer" function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-08T17:00:00.000Z
CVE-2014-7186 
The redirection implementation in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via crafted use of here documents, aka the "redir_stack" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-28T19:00:00.000Z
CVE-2014-7187 
Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via deeply nested for loops, aka the "word_lineno" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-28T19:00:00.000Z
CVE-2014-7188 
The hvm_msr_read_intercept function in arch/x86/hvm/hvm.c in Xen 4.1 through 4.4.x uses an improper MSR range for x2APIC emulation, which allows local HVM guests to cause a denial of service (host crash) or read data from the hypervisor or other guests via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-02T14:00:00.000Z
CVE-2014-7189 
crpyto/tls in Go 1.1 before 1.3.2, when SessionTicketsDisabled is enabled, allows man-in-the-middle attackers to spoof clients via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-07T14:00:00.000Z
CVE-2014-7190 
Multiple cross-site request forgery (CSRF) vulnerabilities in Openfiler 2.99.1 allow remote attackers to hijack the authentication of administrators for requests that (1) shutdown or (2) reboot the server via a request to admin/system_shutdown.html.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-30T16:00:00.000Z
CVE-2014-7191 
The qs module before 1.0.0 in Node.js does not call the compact function for array data, which allows remote attackers to cause a denial of service (memory consumption) by using a large index value to create a sparse array.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-19T01:00:00.000Z
CVE-2014-7192 
Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rational Application Developer and other products, allows remote attackers to execute arbitrary code via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-11T11:00:00.000Z
CVE-2014-7193 
The Crumb plugin before 3.0.0 for Node.js does not properly restrict token access in situations where a hapi route handler has CORS enabled, which allows remote attackers to obtain sensitive information, and potentially obtain the ability to spoof requests to non-CORS routes, via a crafted web site that is visited by an application consumer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-25T11:00:00.000Z
CVE-2014-7194 
TIBCO Managed File Transfer Internet Server before 7.2.4, Managed File Transfer Command Center before 7.2.4, Slingshot before 1.9.3, and Vault before 1.1.1 allow remote attackers to obtain sensitive information or modify data by leveraging agent access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-21T02:00:00.000Z
CVE-2014-7195 
Spotfire Web Player Engine in TIBCO Spotfire Web Player 6.0.x before 6.0.2 and 6.5.x before 6.5.2, Spotfire Deployment Kit 6.0.x before 6.0.2 and 6.5.x before 6.5.2, and Silver Fabric Enabler for Spotfire Web Player before 1.6.1 allows remote authenticated users to obtain sensitive information via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-21T02:00:00.000Z
CVE-2014-7198 
OMERO before 5.0.6 has multiple CSRF vulnerabilities because the framework for OMERO's web interface lacks CSRF protection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-31T23:38:46.000Z
CVE-2014-7199 
Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.19, 1.22.x before 1.22.11, and 1.23.x before 1.23.4 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-30T14:00:00.000Z
CVE-2014-7200 
Cross-site scripting (XSS) vulnerability in pi1/class.tx_dmmjobcontrol_pi1.php in the JobControl (dmmjobcontrol) extension 2.14.0 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via the tx_dmmjobcontrol_pi1[search][keyword] parameter to jobs/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-10T14:00:00.000Z